According to one of the PyArrow maintainers, if we do not pin the pyarrow version in ourĀ conda recipe, it will automatically build packages for all pyarrow versions supported by conda-forge, and we get automatic updates like this PR.
I think eventually for PyPI we should track the major version of pyarrow with our own version number, and backport security/critical bug fixes as needed.