[ChiragAgg5k]

Patches the Brotli decoder out-of-bounds write (CVE-2026-111497) in every copy of Brotli the image carries. This service loads pages from URLs users supply, so any br response it decodes comes from an untrusted server.

Component	Before	After
Bun (bundles its own Brotli)	oven/bun:1.3.2	1.4.4, the patched line; 1.3 gets no fix
Debian libbrotli1	1.1.0-2+b7 (vulnerable)	1.1.0-2+deb13u1 (DSA-6582-1)
Chromium (chromedp/headless-shell)	143.0.7445.3	157.0.8103.15, current stable

The Dockerfile now also fails the build if libbrotli1 is older than 1.1.0-2+deb13u1, so a stale base image can't bring the vulnerable decoder back.

There's no Chrome advisory for this CVE yet. Chromium vendors its own Brotli, so moving to current stable is the best available step, and it also brings 14 major versions of Chrome security fixes.

Tested locally

$ docker run --rm --entrypoint sh appwrite/browser:brotli-test -c 'bun --version; dpkg-query -W libbrotli1; /headless-shell/headless-shell --version'
1.4.4
libbrotli1:arm64	1.1.0-2+deb13u1
Chromium 157.0.8103.15

GET  /v1/health       → {"status":"pass"}
POST /v1/screenshots  {"url":"https://appwrite.io"} → 200, 91 KB PNG (renders correctly)

Test fixes

main's test workflow has failed on its last three runs. b17e41e fixes the two causes:

• The egress suite's beforeAll launches the runner's Chrome, which can take longer than bun's 5s default hook timeout. It now gets 30s.
• should capture full page screenshot compared PNG byte sizes on itznotabug.dev. In CI that site served a short page, so both captures came out about 18 KB. The test now checks the captured height (720 for the viewport, more for the full page) on a long document. It passes locally against the patched image, and 0.3.8 behaves the same on both sites, so Chrome 157 changed nothing here.

[hansi-codes]

🟢 Tier S · Ready to merge

The Docker image updates Bun, Chromium, and Debian's Brotli package, and adds a build-time check for the fixed Debian decoder version. The e2e full-page screenshot test now compares PNG dimensions using a Brotli-related page, while the egress integration setup allows more time for Chrome startup.

Latest changes: The latest commits switch the full-page screenshot fixture to Wikipedia and compare decoded PNG dimensions rather than compressed file sizes, and raise the egress test's browser-launch hook timeout to 30 seconds.

Verdict	New comments	Fixed	Still open
✅ Approved	0	0	0

📂 Walkthrough · 3

File	Change
Dockerfile	Updates Bun, Debian Brotli, and Chromium versions, with a minimum-version build check for libbrotli1.
tests/e2e/endpoints.test.ts	Uses the Brotli article for full-page screenshots and validates image heights from the PNG IHDR.
tests/integration/egress.test.ts	Extends the beforeAll timeout for launching the runner's Chrome.

🔇 Filtered out · 1

Findings Hansi considered but did not post.

Finding

Why

This fixture does not exercise Brotli decoding

Verifier: This is an existing full-page screenshot test, not a Brotli-decoding test. Its unchanged test name, the changed height assertions, and the file history ('deflake the full-page screenshot and egress launch tests') establish that the fixture is used to compare viewport and full-page heights. A gzip-encoded document still exercises that behavior correctly. Nothing in the test claims Brotli coverage, and the repository has no comparable decoder tests; requiring a new decoder smoke test here is not a demonstrated defect in this change.

---

_{Reviewed the commits since 81bcae7 · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🟢 Tier S · Looks good to merge. Summary

[github-actions]

Docker Image Stats

Metric	Value
Image Size	547MB
Memory Usage	108MiB
Cold Start Time	1.02s
Screenshot Time	1.32s

_{Screenshot benchmark: Average of 3 runs on https://appwrite.io}