[HJJung8]

Summary

Closes #1296.

BrotliDecoder calls process() / decompress() with output_buffer_limit, which only exists in Brotli >= 1.2.0 and brotlicffi >= 1.2.0.0. The brotli extra declares minimum versions, but packages that depend on plain httpx2 (for example huggingface_hub) can end up with an older Brotli that happens to be installed already. In that case any br response crashes with TypeError: process() takes no keyword arguments.

This PR checks the importable binding's __version__ once at import time and requires brotli>=1.2.1 or brotlicffi>=1.2.1.0. Earlier releases are vulnerable to CVE-2026-111497 (GHSA-9v8h-qqgm-4m35), as noted in #1311. A binding below the minimum is treated like a missing Brotli install: br is removed from SUPPORTED_DECODERS, so it is no longer advertised in Accept-Encoding. If brotli is too old, brotlicffi is tried next.

The brotli extra is raised to the same minimums, and the missing-decoder error now names them.

Checked against an installed Brotli:

• Brotli==1.1.0 before: TypeError: process() takes no keyword arguments
• Brotli==1.2.0 after: br is not supported, and BrotliDecoder() raises Using 'BrotliDecoder', but neither 'brotli>=1.2.1' nor 'brotlicffi>=1.2.1.0' is installed.
• Brotli==1.2.1 after: br decodes normally

Checklist

• I understand that this PR may be closed in case there was no previous discussion. (This doesn't apply to typos!)
• I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
• I've updated the documentation accordingly.

[codspeed]

Merging this PR will not alter performance

✅ 18 untouched benchmarks
⏩ 7 skipped benchmarks¹

---

_{Comparing HJJung8:fix-brotli-output-buffer-limit (5284c1d) with main (cd6416f)}

Footnotes

1. 7 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[cubic-dev-ai]

All reported issues were addressed across 2 files

<sub>Reply to a comment to ask cubic a question or push back. It learns from your replies.

View guided diff | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Re-trigger cubic</sub>

[mbeijen]

So the problem with 1.2.0 is that it's vulnerable for CVE-2026-111497 'Node2Shell'. (see #1311, this happened AFTER your PR). So it probably would be better to test for minimum version 1.2.1 instead.

Also, the error ""neither of the 'brotlicffi' or 'brotli' packages have been installed". should be improved/changed to reflect the version number.

[HJJung8]

Thanks, done in 5284c1d. The import-time check now requires brotli>=1.2.1 / brotlicffi>=1.2.1.0 by __version__ instead of probing output_buffer_limit, the brotli extra uses the same minimums, and the error now reads: "Using 'BrotliDecoder', but neither 'brotli>=1.2.1' nor 'brotlicffi>=1.2.1.0' is installed." I also merged main to pick up #1311.

[Viicos]

Closing as per #1296 (comment).