v2.31.3

What changed

v2.31.3 is a dependency-only maintenance release of the hardened awaken/avro fork.

• github.com/go-viper/mapstructure/v2: v2.4.0 → v2.5.0
• github.com/klauspost/compress: v1.18.7 → v1.19.2
• github.com/stretchr/testify: v1.9.0 → v1.11.1
• Refreshed all reachable transitive test dependencies, including go-cmp,
  check.v1, kr/pretty, kr/text, and rogpeppe/go-internal.

There are no source-code or public-API changes in this release.

Validation

• Full tests and race tests on Go 1.25 and Go 1.26
• Linux/386 and big-endian Linux/s390x tests
• Cross-platform builds for both commands across all supported CI targets
• All six amd64/386 fuzz jobs
• staticcheck 2026.1
• govulncheck v1.7.0: no vulnerabilities found

Both the pull-request workflows and the independent main push workflows passed in full.

Upgrade

go get github.com/awaken/avro/v2@v2.31.3

v2.31.2

v2.31.2 is the first hardened release of github.com/awaken/avro/v2, based on
the archived hamba/avro v2.31.0 lineage.

Security

• Fix CPU-exhaustion loops in hostile array and map block decoding.
• Validate wire-sized integers before platform narrowing and reject terminal-byte
  varint overflow.
• Enforce cumulative collection budgets and bounded OCF compressed, decompressed,
  and records-per-block limits by default.
• Prevent Deflate, Snappy, and Zstandard decompression amplification.
• Harden generated Go identifiers, enum symbols, and struct tags against source
  injection when Avro name validation is disabled.
• Reject malformed OCF synchronization, empty unions, repeated no-progress reads,
  and unsafe callback limit bypasses.
• Upgrade dependencies past all advisories reported for the final graph.

Correctness and performance

• Decode floats and doubles with Avro's required little-endian byte order on every
  architecture.
• Prevent decoded byte slices from exposing spare reader-slab capacity.
• Clear stale Reader and Writer errors on reset and compile cleanly on 32-bit targets.
• Preserve near-upstream benchmark performance with bounded varint fast paths and
  allocation-free float encoding.

Compatibility

• Module path: github.com/awaken/avro/v2.
• Minimum Go version: 1.25.
• Zero-valued collection and OCF limits now select finite secure defaults. Negative
  values explicitly disable a limit; applications with larger trusted workloads
  should configure documented workload-specific budgets.

Validation

• Native and race suites pass on Go 1.25 and Go 1.26.
• Linux/386 and QEMU Linux/s390x tests pass.
• Ten cross-build targets and six amd64/386 fuzz jobs pass.
• staticcheck and Flower's focused Avro integration suite pass.

Full changelog: v2.31.0...v2.31.2