scoreview-engine v4.7.6-engine.2

release v4.7.6-engine.2

FreeType 2.15.0 and brotli 1.2.1 (#22), both flagged security-critical by
the weekly dependency check (#12). brotli 1.2.1 fixes CVE-2026-111497, an
out-of-bounds write in the decoder that unpacks every woff2 table, fonts
handed to addFont() included; FreeType 2.15.0 carries further fixes of
its own (e.g. CVE-2026-95512).

Output is unchanged: the native corpus report is bit-identical to
v4.7.6-engine.1's for all 570 scores, SVG included, and the wasm gate
fires the same eleven waivers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>