[amrit110]

Why

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder that allows remote code execution through a crafted br-compressed stream. The PyPI Brotli package up to 1.2.0 and brotlicffi 1.2.0.x carry the same decoder. Both are fixed in Brotli 1.2.1 and brotlicffi 1.2.1.0. (Node.js is affected too, but this repo has no Node version pins, so this PR only covers the Python packages.)

What changed

• uv.lock: brotli 1.2.0 to 1.2.1, via uv lock --upgrade-package brotli --upgrade-package brotlicffi with uv 0.9.22 (the version CI pins). No other packages changed. brotlicffi is not in this lock.

How I verified it

• uv lock --locked (uv 0.9.22): passes.
• uv sync --locked (uv 0.9.22): passes; python -c "import brotli; print(brotli.__version__)" prints 1.2.1.
• pre-commit run --files uv.lock: all hooks pass, including uv-lock.
• The repo has no tests/ directory, so there were no unit tests to run. I did not build the Dockerfile.

Deploy impact

No deploy on merge from this repo's workflows: merging runs code checks and unit tests; PyPI publishing runs only on v* tags.

[amrit110]

Superseded by #172, which is merged and already brings brotli 1.2.1 (plus filelock 4.2.1 and opentelemetry-api 1.45.1) to main. Main's code checks pass on that commit.