[dependabot]

Bumps brotli from 1.2.0 to 1.2.1.

Release notes

Sourced from brotli's releases.

v1.2.1

SECURITY

• CVE-2026-111497: out-of-bounds write permits remote code execution

Changelog

Sourced from brotli's changelog.

[1.2.1] - 2026-10-21

SECURITY

• CVE-2026-111497: out-of-bounds write permits remote code execution

Commits

• db24a98 prepare for release
• b418fa8 Detect and report invalid stream earlier.
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[styayur]

The unchanged dependency gate requires zero desktop/production findings. The current integration fixes Brotli/Electron/Undici/fast-uri, but npm still reports 15 moderate desktop and 4 moderate web-tool findings. No compatible complete patched upstream builder graph is currently published.

Created isolated Draft #54 with Brotli 1.2.1, Electron 44.9.1, builder 26.18.0, Undici 6.29.1 and 7.30.1 in their exact desktop paths, and fast-uri 3.1.9. 98 API tests and full pip audit pass. Current API/Windows packaged renderer/Android candidate/CodeQL CI pass. Web gate correctly fails. Inspected modern upstream asar/universal/EJS alternatives and the remaining electron-winstaller -> temp 0.9.4 -> rimraf 2.6.3 -> glob 7.2.3 -> function-export minimatch 3.1.5 chain; no callback-compatible upgrade exists within that chain. A blind minimatch 11 or rimraf 6 override changes the legacy callable APIs. No policy expansion or API shim/version masquerading was applied.

Keep #54 Draft and originals open. Recheck a released builder/winstaller/temp chain or an upstream advisory-range correction, then rerun the full zero-finding gate, real browser tests, Windows packaged renderer and Android candidate checks on the exact combined head. A different packaging toolchain would need its own full migration acceptance. Default-branch Brotli remains an unresolved risk until a valid merge; branch-only fixes are not reported as resolved.

Evidence: #54 https://github.com/styayur/calligra/actions/runs/41487847608 GHSA-g3hv-75wg-m249 github/advisory-database#10811 https://github.com/electron/asar/releases

[dependabot]

Looks like brotli is up-to-date now, so this is no longer needed.

[styayur]

Superseded by the reviewed integration PR #54: #54 . Its merge commit is verified on main, and the unchanged default-branch validation/security workflows pass: https://github.com/styayur/calligra/actions/runs/41644749186, https://github.com/styayur/calligra/actions/runs/41644749189, https://github.com/styayur/calligra/actions/runs/41644749162. The requested compatible changes are included with their required adaptation and lock-bound dependency records. No safety gate or support-floor test was removed; no release/tag or signed asset was published.