[Buildroot] [PATCH] package/{avro-c, python-avro}: security bump to v1.12.2

[Thomas Perale]

In reply of:
> This release includes a broad round of hardening against malformed and
> adversarial input across the Python SDK (bounding allocations and enforcing
> decompression limits before trusting size fields read from the input).
> 
> See the release notes https://avro.apache.org/blog/2026/08/12/avro-1.12.2/
> 
> Also update the download url, because www-eu.apache.org/dist/...
> is a redirection to downloads.apache.org/...
> 
> Signed-off-by: Titouan Christophe <titouan.christophe at mind.be>

Applied to 2025.02.x & 2026.05.x. Thanks

> ---
>  package/avro-c/avro-c.hash           | 4 ++--
>  package/avro-c/avro-c.mk             | 4 ++--
>  package/python-avro/python-avro.hash | 4 ++--
>  package/python-avro/python-avro.mk   | 4 ++--
>  4 files changed, 8 insertions(+), 8 deletions(-)
> 
> diff --git a/package/avro-c/avro-c.hash b/package/avro-c/avro-c.hash
> index 9a53346cd1..4e34c27c23 100644
> --- a/package/avro-c/avro-c.hash
> +++ b/package/avro-c/avro-c.hash
> @@ -1,3 +1,3 @@
> -# Locally computed
> -sha256  b64e31b94719499549622aa92f1d96d1742967ced261a0931b63be3bbe907f2c  avro-c-1.12.1.tar.gz
> +# From https://downloads.apache.org/avro/avro-1.12.2/c/avro-c-1.12.2.tar.gz.sha512
> +sha512  bed6a7e324e7cac52d2bdfe0a596ab90c32c0f99ffecb517a72e465dad5fcfddc49dbfde0efa33e4c8ad73f2e97ad2c90d52f31a51f55b05576a9b36b2c3546b  avro-c-1.12.2.tar.gz
>  sha256  d62488d6ba17132e92c23c03c80bfedc848267f96ab36489fec860f76cf6819a  LICENSE
> diff --git a/package/avro-c/avro-c.mk b/package/avro-c/avro-c.mk
> index 3e41716836..8d18f78cdf 100644
> --- a/package/avro-c/avro-c.mk
> +++ b/package/avro-c/avro-c.mk
> @@ -5,8 +5,8 @@
>  ################################################################################
>  
>  # When updating the version, please also update python-avro
> -AVRO_C_VERSION = 1.12.1
> -AVRO_C_SITE = https://www-eu.apache.org/dist/avro/avro-$(AVRO_C_VERSION)/c
> +AVRO_C_VERSION = 1.12.2
> +AVRO_C_SITE = https://downloads.apache.org/avro/avro-$(AVRO_C_VERSION)/c
>  AVRO_C_LICENSE = Apache-2.0
>  AVRO_C_LICENSE_FILES = LICENSE
>  AVRO_C_INSTALL_STAGING = YES
> diff --git a/package/python-avro/python-avro.hash b/package/python-avro/python-avro.hash
> index f7a241b14d..2941240053 100644
> --- a/package/python-avro/python-avro.hash
> +++ b/package/python-avro/python-avro.hash
> @@ -1,5 +1,5 @@
>  # md5, sha256 from https://pypi.org/pypi/avro/json
> -md5  e2debe491ace30e479944ac4e8e832d9  avro-1.12.1.tar.gz
> -sha256  c5b8dd2dd4c10816f0dc127cc29cfd43b5e405cf7e6840e89460a024bf3d098d  avro-1.12.1.tar.gz
> +md5  0ff774ab3e45a2d48e5b68cd688cba66  avro-1.12.2.tar.gz
> +sha256  e900e7b59a4781f63d9e935e88f6ec50c4d60be3f4adf9c63b51ed39d578fe08  avro-1.12.2.tar.gz
>  # Locally computed sha256 checksums
>  sha256  c79a7fea0e3cac04cd43f20e7b648e5a0ff8fa5344e644b0ee09ca1162b62747  avro/LICENSE
> diff --git a/package/python-avro/python-avro.mk b/package/python-avro/python-avro.mk
> index f13ea9d2ca..37fcf76c90 100644
> --- a/package/python-avro/python-avro.mk
> +++ b/package/python-avro/python-avro.mk
> @@ -5,9 +5,9 @@
>  ################################################################################
>  
>  # When updating the version, please also update avro-c
> -PYTHON_AVRO_VERSION = 1.12.1
> +PYTHON_AVRO_VERSION = 1.12.2
>  PYTHON_AVRO_SOURCE = avro-$(PYTHON_AVRO_VERSION).tar.gz
> -PYTHON_AVRO_SITE = https://files.pythonhosted.org/packages/60/00/af1eec633637e12d0945a97f05a429eed83ac45865af60cb453db4689d95
> +PYTHON_AVRO_SITE = https://files.pythonhosted.org/packages/5f/68/973b9c682aa2c3cf2b05fc4c961af11b9be1d9b46604f65aed23cd4fd1e6
>  PYTHON_AVRO_LICENSE = Apache-2.0
>  PYTHON_AVRO_LICENSE_FILES = avro/LICENSE
>  PYTHON_AVRO_SETUP_TYPE = setuptools
> -- 
> 2.55.0
> 
> _______________________________________________
> buildroot mailing list
> buildroot at buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot