v2.31.2

v2.31.2 is the first hardened release of github.com/awaken/avro/v2, based on
the archived hamba/avro v2.31.0 lineage.

Security

• Fix CPU-exhaustion loops in hostile array and map block decoding.
• Validate wire-sized integers before platform narrowing and reject terminal-byte
  varint overflow.
• Enforce cumulative collection budgets and bounded OCF compressed, decompressed,
  and records-per-block limits by default.
• Prevent Deflate, Snappy, and Zstandard decompression amplification.
• Harden generated Go identifiers, enum symbols, and struct tags against source
  injection when Avro name validation is disabled.
• Reject malformed OCF synchronization, empty unions, repeated no-progress reads,
  and unsafe callback limit bypasses.
• Upgrade dependencies past all advisories reported for the final graph.

Correctness and performance

• Decode floats and doubles with Avro's required little-endian byte order on every
  architecture.
• Prevent decoded byte slices from exposing spare reader-slab capacity.
• Clear stale Reader and Writer errors on reset and compile cleanly on 32-bit targets.
• Preserve near-upstream benchmark performance with bounded varint fast paths and
  allocation-free float encoding.

Compatibility

• Module path: github.com/awaken/avro/v2.
• Minimum Go version: 1.25.
• Zero-valued collection and OCF limits now select finite secure defaults. Negative
  values explicitly disable a limit; applications with larger trusted workloads
  should configure documented workload-specific budgets.

Validation

• Native and race suites pass on Go 1.25 and Go 1.26.
• Linux/386 and QEMU Linux/s390x tests pass.
• Ten cross-build targets and six amd64/386 fuzz jobs pass.
• staticcheck and Flower's focused Avro integration suite pass.

Full changelog: v2.31.0...v2.31.2