[CVE] Replace `github.com/hamba/avro` usage

[gregfurman]

Is your feature request related to a problem? Please describe.

The github.com/hamba/avro library is reporting a high severity CVE GO-2026-5048 for all versions up to and including v2.31.0.

Since the project is archived, any remediation requires that the dependency be swapped out for an alternative.

Describe the solution you'd like

The easiest fix would be to replace the dependency with the fork at https://github.com/iskorotkov/avro and use the latest patch version v2.33.1.

Since this is only used by pulsar/schema.go, this would be a trivial fix:

pulsar-client-go/pulsar/schema.go

Line 32 in b47b690

"github.com/hamba/avro/v2"

However, I'm unsure of any other projects currently using this fork in production and have not independently audited it.

Describe alternatives you've considered

Adopt the new https://github.com/twmb/avro library, which would obviously require a refactor. I have quite high confidence in this library since the maintainer has a couple of high impact projects that they manage.

Also, this is currently being used by a couple of projects in production (see https://pkg.go.dev/github.com/twmb/avro?tab=importedby), namely https://github.com/apache/iceberg-go.

Could also re-consider #1191 to add caller-side support for setting the consumer's avro library.

Additional context

Happy to contribute a fix if the maintainers decide on a direction for this.

[gregfurman]

I see there's already a PR for #1518. I have a working change on my local using the https://github.com/twmb/avro approach, so happy to contribute a change if the aforementioned PR is not accepted.

[slachiewicz]

Two things bearing on the choice between the fork and twmb/avro.

redpanda-data/connect already made this decision: #4195
replaced both linkedin/goavro and hamba/avro with twmb/avro and deleted a
571-line normalisation walker, since type coercion and union handling are native
there.

The fork inherits a soe.Codec.Encode aliasing bug from hamba — filed as
iskorotkov/avro#36 with a reproducer. Encode appends onto a shared 10-byte
header slice, so small payloads return aliased buffers and a caller holding two
encodings sees the first mutate. pulsar/schema.go uses Marshal/Unmarshal
rather than soe, so Pulsar is not exposed today, but it is the kind of thing
that arrives with an unmaintained-upstream fork.

Not an argument against #1518 — swapping to the fork fixes the CVE now and is
three call sites. Worth weighing if the choice is being made once.