[fix][sec] Upgrade avro to 1.12.2 - #24992

Merged

merlimat merged 25 commits into

apache:masterfrom

lhotari:lh-avro-1.12.1

Aug 26, 2026

Commits on May 15, 2026

Commits on Aug 18, 2026

Merge remote-tracking branch 'origin/master' into lh-avro-1.12.1
lhotari
committed
d7463e7

Commits on Aug 19, 2026

Commits on Aug 20, 2026

Merge remote-tracking branch 'origin/master' into lh-avro-1.12.1
lhotari
committed
3b543a0
Pin that Schema.JSON does not need its POJOs in the Avro allow-list
lhotari
committed
3e5a0c5
Give applications a supported way to declare Avro-trusted classes
lhotari
committed
b964435
Add trustExactly for declaring classes without following their references
lhotari
committed
8b7d0f2
Trust an application's classes automatically when it builds a schema from them
lhotari
committed
7e89a21
Degrade to a no-op when Avro has no trusted-class validator
lhotari
committed
091765c
Seed the collection types, and drop the broker's own trust declaration
lhotari
committed
077658d
Declare protobuf message classes too, and stop trusting @Stringable types in tests
lhotari
committed
e24fc66
Stop granting the test JVMs a blanket Avro trust
lhotari
committed
7caa7d9
Use trustExactly for protobuf rather than passing a null schema
lhotari
committed
1c9a30f
Revert stray whitespace in ThreadRuntime
lhotari
committed
dedcd56
Address review findings on the trusted-class expansion
lhotari
committed
b7c317b
Fix a vacuous test and doc rot found in review
lhotari
committed
b682a1c

Commits on Aug 21, 2026

Let tests snapshot and restore the declarations themselves
lhotari
committed
79599c2
Drop trusting a class loader wholesale
lhotari
committed
3b1d8fa
Name the nested declarations type State rather than Snapshot
lhotari
committed
2c8e8c0