This is the blog section. It has two categories: News and Releases.
Files in these directories will be listed in reverse chronological order.
News About Apache Avro
New Project Logo
The Apache Avro project has a new project logo!
The old logo was derived from the logo of a (now defunct) aircraft manufacturer
in Great Britain. This posed a risk, as the Apache foundation would not contest
legal action (even if extremely unlikely).
But thanks to Emma Kellam, we now have a new logo! She has made several logo
designs, and after some debate and several votes (it was a close call!), we can
announce the new logo:
The new logo is an homage to the previous logo, which is also triangular and
uses blue colours. The paper airplane embodies keywords like ‘fast’, ‘small’
and ’efficient’. The blobby tail left behind by the airplane makes the icon
unique and embodies ‘flow’ and ’transformation’.
All in all a very nice logo for Apache Avro, which embodies the same keywords.
Thanks for all your hard work Emma, and welcome!
New committer: Christophe Le Saec
The Project Management Committee (PMC) for Apache Avro has invited Christophe
Le Saec to become a committer and we are pleased to announce that
he has accepted.
Christophe definitely puts in the work and, has an impressive breadth of
knowledge about the languages of the Avro SDK!
As an ASF project, we tend to be very conservative about making changes, and
Christophe brings in fresh ideas and very quickly proposes concrete
implementations to prove them. He has a good understanding of Avro, the
motivation to move things forward, and the expertise to make changes! At the
same time, he’s easy to talk to and flexible in coming to a consensus.
Thanks for all your hard work!
New committer: Oscar Westra van Holthe - Kind
The Project Management Committee (PMC) for Apache Avro has invited Oscar
Westra van Holthe - Kind to become a committer and we are pleased to announce that
he has accepted.
Oscar has done some really solid work on the IDL and JavaCC parts of the Java
SDK. We trust his work and think it’s exceptionally high quality. From the
start, he has already doing much of the work of a committer, demonstrated by
his continuous presence in commenting JIRA, reviewing PRs as well as
encouraging and insightful words on the mailing list.
As a bonus, in his spare time, Oscar also maintains the IntelliJ plugin for
IDL support!
Thanks for all your hard work, and welcome!
New PMC member: Michael A. Smith
The Project Management Committee (PMC) for Apache Avro has invited Michael A.
Smith to the PMC and we are pleased to announce that he has accepted.
Notably, Michael has taken a leadership role in ensuring the quality of the
Python SDK, lending his expertise to ensure that Avro has a place in the
python community, while keeping our implementation up-to-date with standards
and modern versions. It’s not an easy task, and we appreciate all he does!
New PMC member: Martin Grigorov
The Project Management Committee (PMC) for Apache Avro is pleased to announce that Martin Grigorov has accepted our invitation to become a PMC member. He has has been active, reliable and responsive to the community and a solid contributor to various SDKs, bringing well-thought out reviews and comments to both old and new PRs and JIRA. He definitely stepped up for the website refactoring and preparing for the 1.11.1 release!
Please join me in welcoming Martin to the Avro PMC!
New committer: Zoltan Csizmadia
The Project Management Committee (PMC) for Apache Avro has invited
Zoltan Csizmadia to become a committer and we are pleased to announce
that he has accepted.
Zoltan has been present in the C# SDK for over two years and has
really increased his activity in maintaining this language in the last
few months. He knows the technology, but more importantly, he is
patient and works well with those of us who rely on the expertise of
others. Recently, he has been engaging with other contributors to
increase the maintainability and quality of the dotnet code, and we
have confidence in his decisions to balance stability of the
established code and the expectations of modern C# developers.
Being a committer enables easier contribution to the project since
there is no need to go via the patch submission process. This should
enable better productivity.
Please join me in congratulating Zoltan on his recognition of great
work thus far in our community.
New committer: Martin Grigorov
The Project Management Committee (PMC) for Apache Avro
has invited Martin Grigorov to become a committer and we are pleased
to announce that he has accepted.
Over the last few months, he has been active, reliable and easy to
work with on PRs and on the mailing list. His work is of high
quality, and he has a breadth of experience in many of the SDK languages.
I’m especially keen to point out the work he’s been doing on the website!
Being a committer enables easier contribution to the
project since there is no need to go via the patch
submission process. This should enable better productivity.
It’s great to have you as part of the team, Martin!
New committer: David Mollitor
The Project Management Committee (PMC) for Apache Avro
has invited David Mollitor to become a committer and we are pleased
to announce that he has accepted.
Since 2017, David has raised and fixed many issues in the
Java SDK. Recently he’s been finding and providing fixes for subtle
performance issues. His work is always high-quality and he is
reactive and pleasant to talk with on code reviews and JIRA.
Being a committer enables easier contribution to the
project since there is no need to go via the patch
submission process. This should enable better productivity.
It’s great to have you as part of the team, David!
Avro joins Apache
Avro has joined the Apache Software Foundation as a Hadoop subproject.
Releases
Avro 1.12.2
The Apache Avro community is pleased to announce the release of Avro 1.12.2!
All signed release artifacts, signatures and verification instructions can be found here
Security Fixes
This release includes a broad round of hardening against malformed and adversarial input across the Java and Python SDKs (bounding allocations and enforcing decompression limits before trusting size fields read from the input), plus a handful of other fixes with security impact in C#, C++ and JavaScript:
C#
AVRO-4196: Package ‘Microsoft.Build.Utilities.Core’ 17.8.3 has a known high severity vulnerability
AVRO-4314: Validate names against the Avro name grammar at parse time
C++
AVRO-4228: BinaryDecoder::arrayNext() does not handle negative block counts
Java
AVRO-4241: BinaryDecoder should verify available bytes before reading
AVRO-4247: Avro compression codecs should verify decompression size
AVRO-4254: Avoid logging datum values in UnresolvedUnionException
AVRO-4300: Bound array/map allocation and skipping when decoding on both the classic and fast readers
AVRO-4313: javaAnnotation values can inject arbitrary Java code into generated sources
AVRO-4323: Bound DataFileStream block size against available input before allocating the block buffer
AVRO-4324: Align ReflectDatumReader.readArray with GenericDatumReader eager-allocation guards for malformed input
AVRO-4325: Validate column-file header counts and lengths before allocating in the Trevni readers
JavaScript
AVRO-4252: Update JS dependencies with security issues
Python
AVRO-4290: Enforce a maximum decompressed block size
AVRO-4296: Bound allocation when decoding length-prefixed values and collections
Breaking Changes
Java
The Avro 1.12.2 Java SDK now restricts arbitrary Java classes from being instantiated, either from the SpecificDatumReader or java-class attributes in a schema.
If you are not setting the org.apache.avro.SERIALIZABLE_CLASSES or org.apache.avro.SERIALIZABLE_PACKAGES system properties, you may experience the following java.lang.SecurityException:
java.lang.SecurityException: Forbidden com.example.MyCustomClass!
This class is not trusted to be included in Avro schemas.
at org.apache.avro.util.ClassSecurityValidator.validate(ClassSecurityValidator.java:60)
at org.apache.avro.util.ClassUtils.forName(ClassUtils.java:99)
...
The recommended action is to list the classes and packages that Avro is allowed to instantiate in the org.apache.avro.SERIALIZABLE_CLASSES or org.apache.avro.SERIALIZABLE_PACKAGES system properties.
If you are running Avro in an environment with trusted schemas and trusted data, you can restore the old behaviour by setting org.apache.avro.SERIALIZABLE_PACKAGES to *
(or calling ClassSecurityValidator.setGlobal(...) to trust your own classes).
Highlights
C
AVRO-4246: Memory leak in avroc on failed decoding
AVRO-4270: Fix wrong schema accessor in avro_generic_map_class
C#
AVRO-2825: C# Logical Types throw exception on unknown logical type
The Apache Avro community is pleased to announce the release of Avro 1.11.0!
All signed release artifacts, signatures and verification instructions can
be found here
This release includes 120 Jira issues, including some interesting features:
Specification: AVRO-3212 Support documentation tags for FIXED types
C#: AVRO-2961 Support dotnet framework 5.0
C#: AVRO-3225 Prevent memory errors when deserializing untrusted data
C++: AVRO-2923 Logical type corrections
Java: AVRO-2863 Support Avro core on android
Javascript: AVRO-3131 Drop support for node.js 10
Perl: AVRO-3190 Fix error when reading from EOF
Python: AVRO-2906 Improved performance validating deep record data
Python: AVRO-2914 Drop Python 2 support
Python: AVRO-3004 Drop Python 3.5 support
Ruby: AVRO-3108 Drop Ruby 2.5 support
For the first time, the 1.11.0 release includes experimental support for
Rust. Work is continuing on this donated SDK, but we have not versioned and
published official artifacts for this release.
Python: The avro package fully supports Python 3. We will no longer publish a
separate avro-python3 package