From 7b1c5d6b1463489875197d4d714a19719b1a6036 Mon Sep 17 00:00:00 2001 From: Illia Volochii Date: Wed, 21 Oct 2026 19:51:59 +0000 Subject: [PATCH 1/2] Upgrade libbrotli to 1.2.1.0 and release it --- HISTORY.rst | 5 +++-- libbrotli | 2 +- src/brotlicffi/__init__.py | 2 +- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/HISTORY.rst b/HISTORY.rst index 757ac7e..6013f4a 100644 --- a/HISTORY.rst +++ b/HISTORY.rst @@ -1,9 +1,10 @@ Changelog ========= -Unreleased ----------- +1.2.1.0 (2026-10-21) +-------------------- +- Upgraded libbrotli to v1.2.1. - Changed one-shot ``decompress()`` and streaming ``Decompressor.process()`` / ``Decompressor.decompress()`` to raise ``brotlicffi.error`` for trailing bytes after a complete Brotli stream, including calls without an output limit. diff --git a/libbrotli b/libbrotli index e230f47..db24a98 160000 --- a/libbrotli +++ b/libbrotli @@ -1 +1 @@ -Subproject commit e230f474b87134e8c6c85b630084c612057f253e +Subproject commit db24a98aed38a16de78cc05ca15cdd8dc2a0d92d diff --git a/src/brotlicffi/__init__.py b/src/brotlicffi/__init__.py index f7b564d..b7c99af 100644 --- a/src/brotlicffi/__init__.py +++ b/src/brotlicffi/__init__.py @@ -5,4 +5,4 @@ Compressor, MODE_GENERIC, MODE_TEXT, MODE_FONT, error, Error ) -__version__ = "1.2.0.2" +__version__ = "1.2.1.0" From 8325f8cc4c12c28a6ee83090163b944e67ad4ab9 Mon Sep 17 00:00:00 2001 From: Illia Volochii Date: Wed, 21 Oct 2026 19:58:27 +0000 Subject: [PATCH 2/2] Mention the CVE in the changelog --- HISTORY.rst | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/HISTORY.rst b/HISTORY.rst index 6013f4a..7ae7680 100644 --- a/HISTORY.rst +++ b/HISTORY.rst @@ -4,7 +4,8 @@ Changelog 1.2.1.0 (2026-10-21) -------------------- -- Upgraded libbrotli to v1.2.1. +- Upgraded libbrotli to v1.2.1, which remediates CVE-2026-111497, an + out-of-bounds write that permits remote code execution. - Changed one-shot ``decompress()`` and streaming ``Decompressor.process()`` / ``Decompressor.decompress()`` to raise ``brotlicffi.error`` for trailing bytes after a complete Brotli stream, including calls without an output limit.