chore(deps-dev): bump avro-js from 1.12.1 to 1.12.2

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps avro-js from 1.12.1 to 1.12.2.

Release notes

Sourced from avro-js's releases.

release-1.12.2

The Apache Avro community is pleased to announce the release of Avro 1.12.2!

All signed release artifacts, signatures and verification instructions can be found here

Security Fixes

This release includes a broad round of hardening against malformed and adversarial input across the Java and Python SDKs (bounding allocations and enforcing decompression limits before trusting size fields read from the input), plus a handful of other fixes with security impact in C#, C++ and JavaScript:

C#

• AVRO-4196: Package 'Microsoft.Build.Utilities.Core' 17.8.3 has a known high severity vulnerability
• AVRO-4314: Validate names against the Avro name grammar at parse time

C++

• AVRO-4228: BinaryDecoder::arrayNext() does not handle negative block counts

Java

• AVRO-4241: BinaryDecoder should verify available bytes before reading
• AVRO-4247: Avro compression codecs should verify decompression size
• AVRO-4254: Avoid logging datum values in UnresolvedUnionException
• AVRO-4300: Bound array/map allocation and skipping when decoding on both the classic and fast readers
• AVRO-4313: javaAnnotation values can inject arbitrary Java code into generated sources
• AVRO-4323: Bound DataFileStream block size against available input before allocating the block buffer
• AVRO-4324: Align ReflectDatumReader.readArray with GenericDatumReader eager-allocation guards for malformed input
• AVRO-4325: Validate column-file header counts and lengths before allocating in the Trevni readers

JavaScript

• AVRO-4252: Update JS dependencies with security issues

... (truncated)

Commits

• 8fa2067 AVRO-4241: [Java] Bound zero-byte collection elements per datum, not per coll...
• e39580d AVRO-4296: [python] Bound zero-byte collection elements per datum, not per co...
• 478ed0b AVRO-4290: [python] Enforce a maximum decompressed block size (#3850)
• c702676 AVRO-4296: [python] Bound allocation when decoding length-prefixed values and...
• d5a84a3 AVRO-4232: [Build] Install uv in the Docker build image (#3925)
• 14a0097 AVRO-4323: [Java] Bound DataFileStream block size against available input bef...
• 769f9ce AVRO-4324: [Java] Align ReflectDatumReader.readArray with GenericDatumReader ...
• 718e198 AVRO-4325: [Trevni] Validate column-file header counts and lengths before all...
• 861eea1 AVRO-4322: Use reader/writers constently with model (#3924)
• ed2ee6a AVRO-4232: [Python] Backport uv/ruff tooling to branch-1.12 (#3922)
• Additional commits viewable in compare view

[svozza]

It looks like the underscore dependency was removed from avro-jsas part of a security patch but there is still a file in the project that tries to require it (https://github.com/apache/avro/blob/2b5fe02502b77fc33c7b2f1a1f8184d46d7700d4/lang/js/etc/deprecated/validator.js#L16). This causes a Cannot find module 'underscore’ error whenever you try to do a clean install. I've reported the issue to the Avro maintainers and will post any update here when I hear more.

[svozza]

PR to fix issue: apache/avro#3970.

[github-actions]

Approved automatically: non-major bump of a direct development dependency, with all commits authored by Dependabot and signed by GitHub.

Withdrawn automatically: this pull request no longer satisfies the automated merge gates.

[github-actions]

Approved automatically: non-major bump of a direct development dependency, with all commits authored by Dependabot and signed by GitHub.

[dreamorosi]

Approved automatically: non-major bump of a direct development dependency, with all commits authored by Dependabot and signed by GitHub.

@svozza could we make it that it doesn't approve it if the CI is red?

[svozza]

Approved automatically: non-major bump of a direct development dependency, with all commits authored by Dependabot and signed by GitHub.

@svozza could we make it that it doesn't approve it if the CI is red?

Yeah, I was looking into that last night and it should be possible.

[svozza]

@dreamorosi for context on why this PR shows an automated approval sitting on top of failing packages/kafka tests: the auto-merge workflow approves based on provenance and scope only (it's a Dependabot dev-dep, non-major, all commits Dependabot-authored and GitHub-signed). It does not look at test results — that's deliberately left to branch protection. The approval arms GitHub's native auto-merge, but a required check (run-unit-tests / unit-tests-complete) is red, so the PR cannot merge until that's green. It's safely parked, not about to merge.

We considered moving the approval to only happen after tests go green. It's doable, but it requires switching the workflow's trigger from pull_request to workflow_run (approval has to happen after tests finish, and pull_request fires before they start). workflow_run runs from main with a write-capable, secret-bearing token, which is the elevated-privilege trigger class we deliberately avoided in the original design. It's still safe provided the workflow never checks out or executes PR code and passes all PR-controlled values through env (both of which the current workflow already does) — but it's a genuine security-posture change, plus it can no longer be tested on a branch (only runs from main).

The main downside of the current behaviour is that an "approved" badge on a PR with failing tests is misleading at a glance.