[SPARK-53954][BUILD] Bump Avro 1.12.1

[pan3793]

What changes were proposed in this pull request?

As title, bump Avro to the latest patched version (contains security fixes).

Why are the changes needed?

Release Notes are available at apache/avro#3518

Does this PR introduce any user-facing change?

No.

How was this patch tested?

Pass GHA.

Was this patch authored or co-authored using generative AI tooling?

No.

[pan3793]

I'm not sure if there are some bugs in sbt-pom-reader, I manually checked the output of build/sbt dependencyTree and ensured there is no jackson-databind:2.20.0, but the test fails consistently with

$ build/sbt -Phive "hive/testOnly org.apache.spark.sql.hive.JavaDataFrameSuite"
...
[error] Caused by: java.lang.ExceptionInInitializerError: Exception com.fasterxml.jackson.databind.JsonMappingException: Scala module 2.19.2 requires Jackson Databind version >= 2.19.0 and < 2.20.0 - Found jackson-databind version 2.20.0 [in thread "pool-1-thread-1"]
[error]     at com.fasterxml.jackson.module.scala.JacksonModule.setupModule(JacksonModule.scala:61)
[error]     at com.fasterxml.jackson.module.scala.JacksonModule.setupModule$(JacksonModule.scala:46)
[error]     at com.fasterxml.jackson.module.scala.DefaultScalaModule.setupModule(DefaultScalaModule.scala:17)
[error]     at com.fasterxml.jackson.databind.ObjectMapper.registerModule(ObjectMapper.java:909)
[error]     at org.apache.spark.rdd.RDDOperationScope$.<clinit>(RDDOperationScope.scala:82)
[error]     ... 15 more
[info] Test run finished: 2 failed, 0 ignored, 2 total, 4.527s
[error] Failed: Total 2, Failed 2, Errors 0, Passed 0
[error] Failed tests:
[error] 	org.apache.spark.sql.hive.JavaDataFrameSuite
[error] (Test / testOnly) sbt.TestsFailedException: Tests unsuccessful
[error] Total time: 42 s, completed Oct 20, 2025, 10:32:36 PM

I haven't figured out the root causes, instead, I tried another approach (#52668) to manage the Jackson deps, and it solves the issue.

[dongjoon-hyun]

Thank you, @pan3793 . Yes, let's try #52668 first.

[dongjoon-hyun]

I merged the following. Could you rebase this PR once more, @pan3793 ?

• [SPARK-53958][BUILD] Simplify Jackson deps management by using BOM #52668

[pan3793]

@dongjoon-hyun I rebased on master and verified the test which failed previously, now works

$ build/sbt -Phive "hive/testOnly org.apache.spark.sql.hive.JavaDataFrameSuite"
...
[info] Test org.apache.spark.sql.hive.JavaDataFrameSuite#saveTableAndQueryIt() started
[info] Test run finished: 0 failed, 0 ignored, 2 total, 5.609s
[info] Passed: Total 2, Failed 0, Errors 0, Passed 2
[success] Total time: 275 s (0:04:35.0), completed Oct 22, 2025, 1:27:51 AM

let's wait for CI result.

BTW, this Avro release seems to have security fixes, do you think we should backport this to branch-4.0? if so, jackson bom PR should be backported first.

[dongjoon-hyun]

+1, LGTM. Thank you, @pan3793 .

Merged to master for Apache Spark 4.1.0-preview3.