Vulnerable packages with bundled brotli version #63243

Some packages bundle their own version of Google's brotli library. They are also vulnerable to CVE-2026-111497.
See also: https://broccoli2shell.com/#vendored

MuPDF and UEFITool already have a fix upstream. The affected packages are:
mupdf-* (current version 1.27.0, fixed in 1.28.*)
zathura-pdf-mupdf (needs to be rebuild after mupdf-devel is updated, since it comes with its own MuPDF library)
UEFITool (current version A75, fixed in A76)

DuckDB is also affected, but there is curretnly no upstream fix. Upstream Issue: duckdb/duckdb#27660

Note: woff2 and libjxl appear to use the system brotli library and should not be vulnerable once it is updated.