security: bump brotli@1.2.0

[miurahr]

Pull request type

select from below

• security

Which ticket is resolved?

• issue Current dependency brotli 1.1.0 has vulnerability, update it to brotli 1.2.0 #684

What does this PR change?

• .Bump brotli@1.2.0
• .Use output_buffer_limit argument of brotli decompressor

Other information

[miurahr]

CI failed because brotlicffi does not bump libbrotli@1.2.0 yet.
await python-hyper/brotlicffi#207

[xavier2k6]

CI failed because brotlicffi does not bump libbrotli@1.2.0 yet.

Merged!

• Upgrade libbrotli to v1.2.0 python-hyper/brotlicffi#207

---

1.2.0.0 (2025-11-21)

• Upgraded libbrotli to v1.2.0.
• Added output_buffer_limit parameter to Decompressor.decompress() and
  Decompressor.process() methods to allow mitigation of unexpectedly large
  output. This addresses potential security concerns where maliciously crafted
  compressed data could result in excessive memory usage during decompression.

https://github.com/python-hyper/brotlicffi/blob/v1.2.0.0/HISTORY.rst

[coveralls]

coverage: 87.79%. remained the same
when pulling c327e57 on topic/miurahr/security/brotli-1-2-0
into ccf0def on master.