SECURITY

• CVE-2026-111497: out-of-bounds write permits remote code execution

SECURITY

• CVE-2026-111497: out-of-bounds write permits remote code execution

SECURITY

• CVE-2026-111497: out-of-bounds write permits remote code execution

SECURITY

• python: added Decompressor::can_accept_more_data method and optional
  output_buffer_limit argument Decompressor::process;
  that allows mitigation of unexpectedly large output;
  reported by Charles Chan (https://github.com/charleswhchan)

Added

• decoder / encoder: added static initialization to reduce binary size
• python: allow limiting decoder output (see SECURITY section)
• CLI: brcat alias; allow decoding concatenated brotli streams
• kt: pure Kotlin decoder
• cgo: support "raw" dictionaries
• build: Bazel modules

Removed

• java: dropped finalize() for native entities

Fixed

• java: in compress pass correct length to native encoder

Improved

• build: install man pages
• build: updated / fixed / refined Bazel buildfiles
• encoder: faster encoding
• cgo: link via pkg-config
• python: modernize extension / allow multi-phase module initialization

Changed

• decoder / encoder: static tables use "small" model (allows 2GiB+ binaries)

What's Changed (compared to RC1)

• pick changes from Debian patch by @copybara-service[bot] in #1349
• pick changes from Alpine patch by @copybara-service[bot] in #1348
• pick VCPKG patches by @copybara-service[bot] in #1350
• fix copy-paste in Java decoder by @copybara-service[bot] in #1357

This tag is used for debugging release workflow.

IMPORTANT: though this is a pre-release for v1.2.0, it is expected that some changes will be added before release; most notably concerning build files: patches applied by Alpine, Debian, Conan, VCPKG will be partially/fully integrated.

SECURITY

• python: added Decompressor::can_accept_more_data method and optional
  output_buffer_limit argument Decompressor::process;
  that allows mitigation of unexpectedly large output;
  reported by Charles Chan (https://github.com/charleswhchan)

Added

• decoder / encoder: added static initialization to reduce binary size
• python: allow limiting decoder output (see SECURITY section)
• CLI: brcat alias; allow decoding concatenated brotli streams
• kt: pure Kotlin decoder
• cgo: support "raw" dictionaries
• build: Bazel modules

Removed

• java: dropped finalize() for native entities

Fixed

• java: in compress pass correct length to native encoder

Improved

• build: install man pages
• build: updated / fixed / refined Bazel buildfiles
• encoder: faster encoding
• cgo: link via pkg-config
• python: modernize extension / allow multi-phase module initialization

Changed

• decoder / encoder: static tables use "small" model (allows 2GiB+ binaries)

Added

• decoder: BrotliDecoderAttachDictionary
• decoder: BrotliDecoderOnFinish callback behind BROTLI_REPORTING
• decoder: BrotliDecoderSetMetadataCallbacks
• encoder: BrotliEncoderPrepareDictionary,
  BrotliEncoderDestroyPreparedDictionary,
  BrotliEncoderAttachPreparedDictionary
• decoder: BrotliEncoderOnFinish callback behind BROTLI_REPORTING
• common: BrotliSharedDictionaryCreateInstance,
  BrotliSharedDictionaryDestroyInstance,
  BrotliSharedDictionaryAttach
• CLI: --dictionary option
• java: encoder wrapper: Parameters.mode
• java: Brotli{Input|Output}Stream.attachDictionary
• java: wrapper: partial byte array input
• typescript: decoder (transpiled from Java)

Removed

• build: BROTLI_BUILD_PORTABLE option

Fixed

• java: JNI decoder failed sometimes on power of 2 payloads

Improved

• java / js: smaller decoder footprint
• decoder: faster decoding
• encoder: faster encoding
• encoder: smaller stack frames

Added

• decoder: BrotliDecoderAttachDictionary
• decoder: BrotliDecoderOnFinish callback behind BROTLI_REPORTING
• decoder: BrotliDecoderSetMetadataCallbacks
• encoder: BrotliEncoderPrepareDictionary,
  BrotliEncoderDestroyPreparedDictionary,
  BrotliEncoderAttachPreparedDictionary
• decoder: BrotliEncoderOnFinish callback behind BROTLI_REPORTING
• common: BrotliSharedDictionaryCreateInstance,
  BrotliSharedDictionaryDestroyInstance,
  BrotliSharedDictionaryAttach
• CLI: --dictionary option
• java: encoder wrapper: Parameters.mode
• java: Brotli{Input|Output}Stream.attachDictionary
• java: wrapper: partial byte array input
• typescript: decoder (transpiled from Java)

Removed

• build: BROTLI_BUILD_PORTABLE option

Fixed

• java: JNI decoder failed sometimes on power of 2 payloads

Improved

• java / js: smaller decoder footprint
• decoder: faster decoding
• encoder: faster encoding
• encoder: smaller stack frames

SECURITY: decoder: fix integer overflow when input chunk is larger than 2GiB (CVE-2020-8927)

Other changes:

• add support WASM (emscripten) build
• brotli -v now reports raw / compressed size
• build files / docs maintenance
• reduce sources tarball size
• decoder: minor speed / memory usage improvements
• encoder: fix rare access to uninitialized data in ring-buffer
• encoder: improve support for platforms that does not have log2
• encoder: better support for MSVC (replacement for __builtin_clz and __builtin_ctzll
• python: decompress now reports error if there is unused after the end of compressed input