Bump brotli and brotlicffi to patched versions

brotli 1.2.1 and brotlicffi 1.2.1.0 fix CVE-2026-111497
(GHSA-9v8h-qqgm-4m35), an out-of-bounds write in the Brotli decoder.
The exact pins kept installs from picking up the fix.

Relocking also moves the dev-only filelock to 4.2.4, the other finding
failing dependency-audit.

Author: lelia

CHANGELOG.md

@@ -11,6 +11,15 @@
 
 ## 2.11.4
 
+### Fixed: bump `brotli` and `brotlicffi` to patched versions
+
+- Bumped the pinned `brotli` (CPython) from `1.2.0` to `1.2.1` and `brotlicffi`
+  (other implementations) from `1.2.0.2` to `1.2.1.0`, which fix
+  CVE-2026-111497 (GHSA-9v8h-qqgm-4m35), an out-of-bounds write in the Brotli
+  decoder. The pins are exact, so earlier releases couldn't be installed
+  alongside the patched versions.
+- The CLI only compresses with Brotli and never runs the affected decoder.
+
 ### Fixed: find the reachability facts file when `--target-path` isn't the working directory
 
 - `--only-facts-file` and `--reach-use-only-pregenerated-sboms` now submit the

pyproject.toml

@@ -19,8 +19,8 @@ dependencies = [
     "socketdev==3.6.1",
     "beautifulsoup4==4.15.0",
     "markdown==3.11.1",
-    "brotli==1.2.0; platform_python_implementation == 'CPython'",
-    "brotlicffi==1.2.0.2; platform_python_implementation != 'CPython'",
+    "brotli==1.2.1; platform_python_implementation == 'CPython'",
+    "brotlicffi==1.2.1.0; platform_python_implementation != 'CPython'",
     # requests' CA bundle. A floor rather than an exact pin, so later trust-store
     # fixes still reach installs; 2026.10.19 drops the roots behind the
     # compromised eMudhra intermediates.