Best effort

We recently fixed a critical CVE and recommended all users upgrade to the latest release.

Some users for various reasons cannot upgrade quickly, so I am also backporting this fix to an older release.

We know that 2025.9.1 is heavily used by the RAPIDS community, so I'm going to cherry-pick the CVE fix back to that release and make a new tag of 2025.9.2. This wont affect the majority of users, but for those with an ==2025.9.1 pin they will be able to safely move to a ==2025.9.2 pin.

We also know that dask-awkward is dependent on 2025.3.0 so will be making a 2025.3.1 release with the CVE fix. (xref dask/distributed#9181)

If there are other popular releases that folks are pinned to I'm happy to do the same for those releases too.