From f486a69ef26493a89baa457d515347179d8ec90c Mon Sep 17 00:00:00 2001
From: npeter83 <npeter83+claude@gmail.com>
Date: Fri, 23 Oct 2026 17:10:38 +0200
Subject: [PATCH] fix(deps): brotli 1.2.1 (PYSEC-2026-4322)

---
 backend/requirements.lock | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/backend/requirements.lock b/backend/requirements.lock
index 88f15315..487b8557 100644
--- a/backend/requirements.lock
+++ b/backend/requirements.lock
@@ -6,7 +6,7 @@
 # bumped in place instead of a full regeneration, which would move every other package too — then
 # `pip install -r requirements.lock && pip check` must pass. In place so far: urllib3 2.7.0 -> 2.8.0 (PYSEC-2026-4175/4176/4177); yt-dlp 2026.7.4 -> 2026.8.19
 # (it marks the clients that need a stream PO token, so the downloader stops fetching into a 403);
-# certifi 2026.7.22 -> 2026.10.19 (GHSA-6q48-6c7w-9gw2).
+# certifi 2026.7.22 -> 2026.10.19 (GHSA-6q48-6c7w-9gw2); brotli 1.2.0 -> 1.2.1 (PYSEC-2026-4322).
 APScheduler==3.11.3
 Authlib==1.7.2
 Mako==1.4.1
@@ -21,7 +21,7 @@ anyio==4.14.2
 argon2-cffi-bindings==25.1.0
 argon2-cffi==25.1.0
 bgutil-ytdlp-pot-provider==1.3.1
-brotli==1.2.0
+brotli==1.2.1
 certifi==2026.10.19
 cffi==2.1.1
 charset-normalizer==3.5.1