[amrit110]

Why

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder that allows remote code execution through a crafted br-compressed stream. The PyPI Brotli package up to 1.2.0 and brotlicffi 1.2.0.x carry the same decoder. Both are fixed in Brotli 1.2.1 and brotlicffi 1.2.1.0. (Node.js is affected too, but this repo has no Node version pins, so this PR only covers the Python packages.)

What changed

• uv.lock: brotli 1.2.0 to 1.2.1, via uv lock --upgrade-package brotli --upgrade-package brotlicffi with uv 0.10.9 (the newest uv the workflows pin). No other packages changed. brotlicffi is not in this lock.

How I verified it

• uv lock --locked (uv 0.10.9): passes.
• uv sync --locked (uv 0.10.9): passes; python -c "import brotli; print(brotli.__version__)" prints 1.2.1.
• pre-commit run --files uv.lock: all hooks pass, including uv-lock.
• I did not count the tests: the only test file (tests/tool_tests/test_integration.py) holds integration tests that need API keys and services I do not have (they error on missing config), and pytest is commented out in unit_tests.yml.

Deploy impact

No app deploy on merge. docs.yml runs on push to main when uv.lock changes and redeploys the docs site to GitHub Pages. PyPI publishing runs only on a published release.