[jeffdupont]

Summary

brotlicffi before 1.2.1.0 has an out-of-bounds write in the Brotli decoder (GHSA-9v8h-qqgm-4m35, affected range >=1.0.3, <1.2.1.0). This PR raises the floor in the root dev dependency group from >=1.0 to >=1.2.1.0 and relocks only that package with uv lock --upgrade-package brotlicffi.

• pyproject.toml: brotlicffi>=1.2.1.0
• uv.lock: brotlicffi 1.2.0.1 → 1.2.1.0. The lockfile revision goes from 3 to 5 because the lock was written with uv 0.13.5. CI's setup-uv@v5 installs the latest uv, so it can read revision 5.

Scope: no published package declares brotlicffi. The only consumer is the workspace dev group, so released wheels are unaffected and this PR changes dev and CI environments only.

Jira: AIC-3679

Testing

• uv lock --check passes, and uv sync --all-packages installs brotlicffi 1.2.1.0
• ruff check and ruff format --check are clean
• uv run pytest: 3449 passed, 18 skipped, 2 failed. Both failures are in packages/client/tests/test_lifecycle.py::TestInitClientSDKKeyPath (test_uses_options_sdk_key_over_env_var and test_retries_after_a_failed_init_instead_of_replaying_it). The same 2 tests fail on the pre-bump lockfile with brotlicffi 1.2.0.1, and the file passes when run alone (60/60). They look like state leaking between tests, and this change did not cause them.

🤖 Generated with Claude Code

---

Note

Overview
Raises the workspace dev dependency floor for brotlicffi from >=1.0 to >=1.2.1.0 and relocks uv.lock so CI/dev installs 1.2.1.0 instead of 1.2.0.1. This addresses GHSA-9v8h-qqgm-4m35 (out-of-bounds write in the Brotli decoder). The lockfile revision also advances (3 → 5) from the uv version used when relocking.

Scope: brotlicffi is only declared in the root dev group—not in shipped packages—so released wheels are unchanged; only local dev and CI dependency resolution are affected.

^{Reviewed by Cursor Bugbot for commit 4867d48. Bugbot is set up for automated code reviews on this repo. Configure here.}