chore(deps-dev): bump avro-js from 1.12.1 to 1.12.2

[dependabot]

Bumps avro-js from 1.12.1 to 1.12.2.

Release notes

Sourced from avro-js's releases.

release-1.12.2

The Apache Avro community is pleased to announce the release of Avro 1.12.2!

All signed release artifacts, signatures and verification instructions can be found here

Security Fixes

This release includes a broad round of hardening against malformed and adversarial input across the Java and Python SDKs (bounding allocations and enforcing decompression limits before trusting size fields read from the input), plus a handful of other fixes with security impact in C#, C++ and JavaScript:

C#

• AVRO-4196: Package 'Microsoft.Build.Utilities.Core' 17.8.3 has a known high severity vulnerability
• AVRO-4314: Validate names against the Avro name grammar at parse time

C++

• AVRO-4228: BinaryDecoder::arrayNext() does not handle negative block counts

Java

• AVRO-4241: BinaryDecoder should verify available bytes before reading
• AVRO-4247: Avro compression codecs should verify decompression size
• AVRO-4254: Avoid logging datum values in UnresolvedUnionException
• AVRO-4300: Bound array/map allocation and skipping when decoding on both the classic and fast readers
• AVRO-4313: javaAnnotation values can inject arbitrary Java code into generated sources
• AVRO-4323: Bound DataFileStream block size against available input before allocating the block buffer
• AVRO-4324: Align ReflectDatumReader.readArray with GenericDatumReader eager-allocation guards for malformed input
• AVRO-4325: Validate column-file header counts and lengths before allocating in the Trevni readers

JavaScript

• AVRO-4252: Update JS dependencies with security issues

... (truncated)

Commits

• 8fa2067 AVRO-4241: [Java] Bound zero-byte collection elements per datum, not per coll...
• e39580d AVRO-4296: [python] Bound zero-byte collection elements per datum, not per co...
• 478ed0b AVRO-4290: [python] Enforce a maximum decompressed block size (#3850)
• c702676 AVRO-4296: [python] Bound allocation when decoding length-prefixed values and...
• d5a84a3 AVRO-4232: [Build] Install uv in the Docker build image (#3925)
• 14a0097 AVRO-4323: [Java] Bound DataFileStream block size against available input bef...
• 769f9ce AVRO-4324: [Java] Align ReflectDatumReader.readArray with GenericDatumReader ...
• 718e198 AVRO-4325: [Trevni] Validate column-file header counts and lengths before all...
• 861eea1 AVRO-4322: Use reader/writers constently with model (#3924)
• ed2ee6a AVRO-4232: [Python] Backport uv/ruff tooling to branch-1.12 (#3922)
• Additional commits viewable in compare view

[svozza]

It looks like the underscore dependency was removed from avro-jsas part of a security patch but there is still a file in the project that tries to require it (https://github.com/apache/avro/blob/2b5fe02502b77fc33c7b2f1a1f8184d46d7700d4/lang/js/etc/deprecated/validator.js#L16). This causes a Cannot find module 'underscore’ error whenever you try to do a clean install. I've reported the issue to the Avro maintainers and will post any update here when I hear more.

[svozza]

PR to fix issue: apache/avro#3970.