chore(deps): bump avro from 1.12.1 to 1.12.2

[dependabot]

Bumps avro from 1.12.1 to 1.12.2.

Release notes

Sourced from avro's releases.

release-1.12.2

The Apache Avro community is pleased to announce the release of Avro 1.12.2!

All signed release artifacts, signatures and verification instructions can be found here

Security Fixes

This release includes a broad round of hardening against malformed and adversarial input across the Java and Python SDKs (bounding allocations and enforcing decompression limits before trusting size fields read from the input), plus a handful of other fixes with security impact in C#, C++ and JavaScript:

C#

• AVRO-4196: Package 'Microsoft.Build.Utilities.Core' 17.8.3 has a known high severity vulnerability
• AVRO-4314: Validate names against the Avro name grammar at parse time

C++

• AVRO-4228: BinaryDecoder::arrayNext() does not handle negative block counts

Java

• AVRO-4241: BinaryDecoder should verify available bytes before reading
• AVRO-4247: Avro compression codecs should verify decompression size
• AVRO-4254: Avoid logging datum values in UnresolvedUnionException
• AVRO-4300: Bound array/map allocation and skipping when decoding on both the classic and fast readers
• AVRO-4313: javaAnnotation values can inject arbitrary Java code into generated sources
• AVRO-4323: Bound DataFileStream block size against available input before allocating the block buffer
• AVRO-4324: Align ReflectDatumReader.readArray with GenericDatumReader eager-allocation guards for malformed input
• AVRO-4325: Validate column-file header counts and lengths before allocating in the Trevni readers

JavaScript

• AVRO-4252: Update JS dependencies with security issues

... (truncated)

Commits

• 8fa2067 AVRO-4241: [Java] Bound zero-byte collection elements per datum, not per coll...
• e39580d AVRO-4296: [python] Bound zero-byte collection elements per datum, not per co...
• 478ed0b AVRO-4290: [python] Enforce a maximum decompressed block size (#3850)
• c702676 AVRO-4296: [python] Bound allocation when decoding length-prefixed values and...
• d5a84a3 AVRO-4232: [Build] Install uv in the Docker build image (#3925)
• 14a0097 AVRO-4323: [Java] Bound DataFileStream block size against available input bef...
• 769f9ce AVRO-4324: [Java] Align ReflectDatumReader.readArray with GenericDatumReader ...
• 718e198 AVRO-4325: [Trevni] Validate column-file header counts and lengths before all...
• 861eea1 AVRO-4322: Use reader/writers constently with model (#3924)
• ed2ee6a AVRO-4232: [Python] Backport uv/ruff tooling to branch-1.12 (#3922)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.66%. Comparing base (94b9d5e) to head (3d811bc).
⚠️ Report is 1 commits behind head on develop.

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #8462   +/-   ##
========================================
  Coverage    96.66%   96.66%           
========================================
  Files          296      296           
  Lines        14911    14911           
  Branches      1268     1268           
========================================
  Hits         14413    14413           
  Misses         363      363           
  Partials       135      135           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.