[ChristianHandy]

Summary

pip-audit ("Check dependencies for known vulnerabilities") fails the pytest jobs on every pull request (e.g. #246): brotli 1.2.0 has PYSEC-2026-4322, fixed in 1.2.1.

Changes

• requirements-lock.txt: brotli 1.2.0 → 1.2.1, regenerated with uv pip compile ... --upgrade-package brotli (no other package changes; the dev lock has no brotli pin of its own).
• CHANGELOG.md: entry under Unreleased → Security.

Verification

• pip-audit --require-hashes --disable-pip -r requirements-lock.txt → no known vulnerabilities
• same for requirements-dev-lock.txt → no known vulnerabilities

AI assistance

Prepared with Claude Code.

🤖 Generated with Claude Code

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
pip/brotli	1.2.1	🟢 7.6	Details Check Score Reason Code-Review ⚠️ 1 Found 4/21 approved changesets -- score normalized to 1 Packaging ⚠️ -1 packaging workflow not detected Security-Policy 🟢 10 security policy file detected Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow ⚠️ -1 no workflows found Token-Permissions ⚠️ -1 No tokens found Pinned-Dependencies ⚠️ -1 no dependencies found Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 2 badge detected: InProgress Vulnerabilities 🟢 10 0 existing vulnerabilities detected Dependency-Update-Tool 🟢 10 update tool detected Fuzzing 🟢 10 project is fuzzed SAST 🟢 9 SAST tool is not run on all commits -- score normalized to 9 Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md License 🟢 10 license file detected CI-Tests 🟢 10 22 out of 22 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 16 contributing companies or organizations

Scanned Files

• requirements-lock.txt

[github-actions]

🟢 Ready to merge

• All required checks passed and there are no merge conflicts. A maintainer still reviews the change before merging.

Commit 53edbcf; updated whenever a check finishes.

What this pull request changes

2 files, +145 / -101 lines.

Area	Files	Added	Deleted
Dependencies	1	+144	-101
Documentation	1	+1	-0

Changed files

• CHANGELOG.md (modified, +1 / -0)
• requirements-lock.txt (modified, +144 / -101)

Required checks

Check	Result
pytest (Python 3.11)	✅ passed
pytest (Python 3.12)	✅ passed
pytest (Python 3.13)	✅ passed
Analyze (python)	✅ passed
Safe to merge	✅ passed
AI assistance	✅ passed

Other checks: 12 passed, 0 failed, 0 running.

[ChristianHandy]

/allow-ai 53edbcf brotli security update