Skip to content

v9.0.22

@wtgodbe wtgodbe tagged this 22 Oct 19:21
#### AI description  (iteration 1)
#### PR Classification
Security fix: upgrades the vendored Brotli library to 1.1.1 to address CVE-2026-111497, an out-of-bounds write vulnerability that could permit remote code execution.

#### PR Summary
This PR updates the bundled Brotli dependency from 1.1.0 to 1.1.1, incorporating a decoder fix for a security vulnerability along with improved error handling in block type/length decoding.
- `dec/decode.c`: Refactors block switch decoding functions to return `BrotliDecoderErrorCode` instead of `BROTLI_BOOL`, enabling more precise error propagation (e.g., distinguishing `NEEDS_MORE_INPUT` from format errors), and adds a new `BROTLI_SAFE_WITH_STATUS` macro.
- `include/brotli/decode.h`: Adds new error code `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (previously reserved as -17).
- `common/version.h` and `brotli-version.txt`: Bump version to 1.1.1 and ABI revision to 1.
- `cgmanifest.json`: Updates commit hash reference to match the new Brotli version.
- Adds `CHANGELOG.md` and `.bazelignore` as new files from the upstream Brotli repository.
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
Assets 2
Loading