# What changed in brotli

> 14 changes in brotli 1 from its official release notes, upgrade guides and advisories: 1 breaking, 3 security, 4 new APIs and options. Each one cited. Sources checked 2026-10-20. HTML: https://unstale.sh/pypi/brotli/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## brotli 1

### Breaking changes

- Java drops finalize() for native entities. (1.2.0) — [release notes](https://github.com/google/brotli/releases/tag/v1.2.0)

### Security

- Python adds a method for determining whether a decompressor can accept more data, helping mitigate unexpectedly large output. (1.2.0) — [release notes](https://github.com/google/brotli/releases/tag/v1.2.0)
- Python adds an optional output buffer limit to process, allowing mitigation of unexpectedly large output. (1.2.0) — [release notes](https://github.com/google/brotli/releases/tag/v1.2.0)
- Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation (1.2.0) — [security advisory](https://github.com/advisories/GHSA-2QFP-Q593-8484)

### New APIs and options

- The CLI adds brcat as an alias. (1.2.0) — [release notes](https://github.com/google/brotli/releases/tag/v1.2.0)
- The Python extension allows multi-phase module initialization. (1.2.0) — [release notes](https://github.com/google/brotli/releases/tag/v1.2.0)
- A pure Kotlin decoder is added. (1.2.0) — [release notes](https://github.com/google/brotli/releases/tag/v1.2.0)
- cgo adds support for raw dictionaries. (1.2.0) — [release notes](https://github.com/google/brotli/releases/tag/v1.2.0)

### Performance

- Encoding is faster. (1.2.0) — [release notes](https://github.com/google/brotli/releases/tag/v1.2.0)
- Static initialization is added to reduce binary size. (1.2.0) — [release notes](https://github.com/google/brotli/releases/tag/v1.2.0)

### Behavior and default changes

- The CLI can decode concatenated brotli streams. (1.2.0) — [release notes](https://github.com/google/brotli/releases/tag/v1.2.0)

### Tooling

- Bazel modules are added to the build. (1.2.0) — [release notes](https://github.com/google/brotli/releases/tag/v1.2.0)
- cgo links via pkg-config. (1.2.0) — [release notes](https://github.com/google/brotli/releases/tag/v1.2.0)

### Fixes and other changes

- Java compress now passes the correct length to the native encoder. (1.2.0) — [release notes](https://github.com/google/brotli/releases/tag/v1.2.0)