apache-arrow: Add reference to CVE-2026-25087

[Leonardo Taccari (via pkgsrc-wip) <commit-notify%pkgsrc.org@localhost>]

Module Name:	pkgsrc-wip
Committed By:	Leonardo Taccari <leot%NetBSD.org@localhost>
Pushed By:	leot
Date:		Wed Feb 18 18:53:00 2026 +0100
Changeset:	f94a93c15500fca9a935eb158fb3e53a3010e460

Modified Files:
	apache-arrow/TODO

Log Message:
apache-arrow: Add reference to CVE-2026-25087

To see a diff of this commit:
https://wip.pkgsrc.org/cgi-bin/gitweb.cgi?p=pkgsrc-wip.git;a=commitdiff;h=f94a93c15500fca9a935eb158fb3e53a3010e460

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

diffstat:
 apache-arrow/TODO | 3 +++
 1 file changed, 3 insertions(+)

diffs:
diff --git a/apache-arrow/TODO b/apache-arrow/TODO
index a74ec0d4dd..4551067005 100644
--- a/apache-arrow/TODO
+++ b/apache-arrow/TODO
@@ -1,3 +1,6 @@
 * Build python support as a separate package
 * Try and run tests?
 * Does not build on NetBSD - Need to fix some Linux-isms
+
+This package has known vulnerabilities, please investigate and fix if possible:
+  CVE-2026-25087