[coaldonac]

Summary

Docs only. Adds a README security note for CVE-2026-111497, a buffer overflow in the Brotli decoder that can lead to remote code execution.

This library ships no Brotli code. The vulnerable decoder belongs to the runtime it runs on. This note tells users what to patch and whether this client ever puts Brotli in front of that decoder.

We deliberately chose not to change client code. An Accept-Encoding change only stops an honest server sending Brotli. It doesn't stop an attacker who controls or tampers with the response, so a patched runtime is the only real fix.

What the client does: httpx only requests and decodes Brotli when the optional brotli or brotlicffi package is installed. Neither is a dependency of this SDK. The note gives the fixed floors: brotli >= 1.2.1 and brotlicffi >= 1.2.1.0. Their wheels bundle libbrotli, so upgrading the package is the fix.

Every claim in the note was checked against the client's source by an open-source maintainer review and a security review before commit. No CHANGELOG entry, because nothing in the shipped software changes. No GHSA, because this is not a vulnerability in this package.

Tracking: PMK-3626

🤖 Generated with Claude Code

[ac-bgelfius]

Approving. Every claim in the note checks out at the version that runs:

• With httpx>=0.28.1,<0.29.0 (this repo's pin), httpx 0.28.1 builds its default Accept-Encoding from the decoders it can import, and drops br unless brotli or brotlicffi is installed. The SDK sets no Accept-Encoding of its own. So "requests and decodes Brotli only when the optional package is installed" is right.
• brotli 1.2.1 and brotlicffi 1.2.1.0 are both on PyPI. Upstream Brotli lists this CVE as fixed in v1.2.1.

Optional: the note could name the affected Brotli range (1.0.3–1.2.0) like the WordPress note does, and remind readers that a long-running process needs a restart to pick up the new package.