Recent Commits to brotli:master

Merge pull request #1528 from tvost2:fix/bsd-mtime-nsec

PiperOrigin-RevId: 974340007

Merge branch 'master' into fix/bsd-mtime-nsec

cli: preserve sub-second mtime on the BSDs (fixes #1515)

HAVE_UTIMENSAT was only set when _POSIX_C_SOURCE >= 200809L or
_ATFILE_SOURCE was defined. FreeBSD, OpenBSD, NetBSD and DragonFly BSD
provide utimensat()/futimens() and nanosecond-resolution stat timestamps
by default without defining either macro, so the CLI fell back to utime()
and truncated the copied mtime to whole seconds (visible as .br files with
a .000000000 nanosecond field next to the source).

Detect those platforms explicitly. The existing non-Apple ATIME_NSEC /
MTIME_NSEC macros already use the st_atim / st_mtim spelling that the BSDs
expose, so no further change is needed.

Merge pull request #1526 from eustas:fix_lint

PiperOrigin-RevId: 973810649

Merge branch 'master' into fix_lint

Merge pull request #1527 from rootkiller6788:fix-parseparams-empty-args-oob

PiperOrigin-RevId: 971820982

Fix new ruff findings

Fix out-of-bounds write in ParseParams for empty-string arguments

Empty-string CLI arguments were recorded in params->not_input_indices
before the "too many options" bounds check ran, so passing more than
MAX_OPTIONS empty-string arguments wrote past the end of the
fixed-size array and corrupted the stack (reproducible crash).
Move the bounds check to the top of the argument loop so every write
site is guarded.

Add params to brotli to manually enable or disable the SIMD hashers.

PiperOrigin-RevId: 959173169

Fix edge cases and stability issues in Brotli Base64 entropy coding optimization.

PiperOrigin-RevId: 955899701

Add an experimental feature to automatically detect Base64 encoded content in the input stream and optimize compression by skipping dictionary and history lookups for these regions. This is controlled by a new parameter BROTLI_PARAM_BASE64_MODE.

PiperOrigin-RevId: 948030912

Merge pull request #1506 from google:dependabot/github_actions/everything-015e380c35

PiperOrigin-RevId: 947908514

Bump the everything group across 1 directory with 7 updates

Bumps the everything group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.19.4` | `2.20.0` |
| [actions/setup-node](https://github.com/actions/setup-node) | `6.4.0` | `7.0.0` |
| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.36.2` | `4.37.0` |
| [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.36.2` | `4.37.0` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.36.2` | `4.37.0` |
| [bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml](https://github.com/bazel-contrib/publish-to-bcr) | `005a51c75c5027e54477d290a21aa57e0a1a65f5` | `ad6879fd015a01c3e3b1b318fe3c061f928ac2fb` |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.36.2` | `4.37.0` |



Updates `step-security/harden-runner` from 2.19.4 to 2.20.0
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](https://github.com/step-security/harden-runner/compare/9af89fc71515a100421586dfdb3dc9c984fbf411...bf7454d06d71f1098171f2acdf0cd4708d7b5920)

Updates `actions/setup-node` from 6.4.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e...820762786026740c76f36085b0efc47a31fe5020)

Updates `github/codeql-action/init` from 4.36.2 to 4.37.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...99df26d4f13ea111d4ec1a7dddef6063f76b97e9)

Updates `github/codeql-action/autobuild` from 4.36.2 to 4.37.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...99df26d4f13ea111d4ec1a7dddef6063f76b97e9)

Updates `github/codeql-action/analyze` from 4.36.2 to 4.37.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...99df26d4f13ea111d4ec1a7dddef6063f76b97e9)

Updates `bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml` from 005a51c75c5027e54477d290a21aa57e0a1a65f5 to ad6879fd015a01c3e3b1b318fe3c061f928ac2fb
- [Release notes](https://github.com/bazel-contrib/publish-to-bcr/releases)
- [Commits](https://github.com/bazel-contrib/publish-to-bcr/compare/005a51c75c5027e54477d290a21aa57e0a1a65f5...ad6879fd015a01c3e3b1b318fe3c061f928ac2fb)

Updates `github/codeql-action/upload-sarif` from 4.36.2 to 4.37.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...99df26d4f13ea111d4ec1a7dddef6063f76b97e9)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: everything
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: everything
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: everything
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: everything
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: everything
- dependency-name: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml
  dependency-version: ad6879fd015a01c3e3b1b318fe3c061f928ac2fb
  dependency-type: direct:production
  dependency-group: everything
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: everything
...

Signed-off-by: dependabot[bot] <support@github.com>

Retain source data for prepared dictionary.

Unlike pure-java prepared dictionary, in native prepared dictionaries source data is not copied, but referenced.

Likely because of copy-paste, `raw_data` field was not populated.

PiperOrigin-RevId: 944339020

Merge pull request #1502 from eustas:zizmor

PiperOrigin-RevId: 943118404

Add zizmor audit

And fix findings.
Drive-by: fix windows build

Merge pull request #1500 from google:dependabot/github_actions/everything-0a43ab5142

PiperOrigin-RevId: 942121953

Bump the everything group across 1 directory with 7 updates

Bumps the everything group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `7.0.0` |
| [actions/setup-python](https://github.com/actions/setup-python) | `6.2.0` | `6.3.0` |
| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.36.0` | `4.36.2` |
| [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.36.0` | `4.36.2` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.36.0` | `4.36.2` |
| [actions/cache](https://github.com/actions/cache) | `5.0.5` | `6.1.0` |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.36.0` | `4.36.2` |



Updates `actions/checkout` from 6.0.2 to 7.0.0
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0)

Updates `actions/setup-python` from 6.2.0 to 6.3.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/a309ff8b426b58ec0e2a45f0f869d46889d02405...ece7cb06caefa5fff74198d8649806c4678c61a1)

Updates `github/codeql-action/init` from 4.36.0 to 4.36.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/7211b7c8077ea37d8641b6271f6a365a22a5fbfa...8aad20d150bbac5944a9f9d289da16a4b0d87c1e)

Updates `github/codeql-action/autobuild` from 4.36.0 to 4.36.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/7211b7c8077ea37d8641b6271f6a365a22a5fbfa...8aad20d150bbac5944a9f9d289da16a4b0d87c1e)

Updates `github/codeql-action/analyze` from 4.36.0 to 4.36.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/7211b7c8077ea37d8641b6271f6a365a22a5fbfa...8aad20d150bbac5944a9f9d289da16a4b0d87c1e)

Updates `actions/cache` from 5.0.5 to 6.1.0
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9)

Updates `github/codeql-action/upload-sarif` from 4.36.0 to 4.36.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/7211b7c8077ea37d8641b6271f6a365a22a5fbfa...8aad20d150bbac5944a9f9d289da16a4b0d87c1e)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: everything
- dependency-name: actions/setup-python
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: everything
- dependency-name: github/codeql-action/init
  dependency-version: 4.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: everything
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: everything
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: everything
- dependency-name: actions/cache
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: everything
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: everything
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #1494 from aleister1102:fix/decoder-jni-push-bounds-check

PiperOrigin-RevId: 932949831

fix(java): validate decoder push length in Wrapper only

Per review feedback, keep the input length upper-bound check in
DecoderJNI.Wrapper.push() and remove the redundant native guard.

Merge pull request #1395 from mmorel-35:bcr

PiperOrigin-RevId: 925175633

Merge branch 'master' into bcr

Merge pull request #1406 from mannewalis:fix/emscripten-detection

PiperOrigin-RevId: 924674243

Merge branch 'master' into bcr

Merge pull request #1487 from google:dependabot/github_actions/step-security/harden-runner-2.19.4

PiperOrigin-RevId: 924665869

Merge branch 'master' into dependabot/github_actions/step-security/harden-runner-2.19.4

Merge branch 'master' into fix/emscripten-detection

Merge pull request #1490 from google:eustas-patch-1

PiperOrigin-RevId: 924650836

Merge branch 'master' into eustas-patch-1

Fix Bazel build

PiperOrigin-RevId: 924648497

Bump step-security/harden-runner from 2.17.0 to 2.19.4

Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.17.0 to 2.19.4.
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](https://github.com/step-security/harden-runner/compare/f808768d1510423e83855289c910610ca9b43176...9af89fc71515a100421586dfdb3dc9c984fbf411)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.19.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #1486 from google:dependabot/github_actions/github/codeql-action-4.36.0

PiperOrigin-RevId: 924639598

Configure Dependabot to group updates

Add grouping for Dependabot updates to combine into a single PR.

Bump github/codeql-action from 4.35.1 to 4.36.0

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.1 to 4.36.0.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/c10b8064de6f491fea524254123dbe5e09572f13...7211b7c8077ea37d8641b6271f6a365a22a5fbfa)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #1466 from google:dependabot/github_actions/actions/setup-node-6.4.0

PiperOrigin-RevId: 924598585

Merge branch 'master' into dependabot/github_actions/actions/setup-node-6.4.0

revert API change

PiperOrigin-RevId: 915873630

make narrowing conversion explicit

PiperOrigin-RevId: 915286311

Clarify RAW dictionary size limits.

Make decoder addon (chunked dictionary) fields unsigned.
Add comments about expected value ranges.

PiperOrigin-RevId: 914736171

Automated Code Change

PiperOrigin-RevId: 910740603

Merge pull request #1463 from parasol-aser:fix/copystat-toctou-1461

PiperOrigin-RevId: 909898919

Convert CopyStat regression tests to Python suite

Fix CopyStat TOCTOU in brotli CLI by using fd-based syscalls

CloseFiles() previously called fclose(context->fout) before invoking
CopyStat() on the output pathname. CopyStat() then used path-based
chmod() and chown(), which gave an attacker with write access to the
output directory a window to replace the path with a symlink between
the close and the metadata syscalls, redirecting the chmod/chown to an
arbitrary target.

Close the race by doing the metadata copy while the output file is
still open and by switching to fd-based syscalls on fileno(fout):

- CopyStat() now takes FILE* fout and calls fchmod()/fchown() on the
  underlying fd.
- CopyTimeStat() uses futimens(fd, ...) in the HAVE_UTIMENSAT branch;
  the legacy utime() fallback is preserved for platforms without it.
- CloseFiles() invokes CopyStat() before fclose() and skips it when
  current_output_path is NULL (stdout), matching the issue's guidance.
- Windows no-op shims updated from chmod/chown to fchmod/fchown.

Adds deterministic regression coverage under tests/regression/t01/:
an LD_PRELOAD fclose() swap reproduces the pre-fix behavior, and a
negative-assertion wrapper confirms the attack no longer succeeds
after the patch. Additional scripts cover mode/timestamp propagation,
the -n (no-copy-stat) flag, stdin input, stdout output, mode mask, and
roundtrip correctness.

Refs google/brotli#1461

Bump actions/setup-node from 6.3.0 to 6.4.0

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.3.0 to 6.4.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/53b83947a5a98c8d113130e565377fae1a50d02f...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #1458 from rbri:java_code_cleanup

PiperOrigin-RevId: 900612609

use try-with-resources

Merge pull request #1453 from 0xazanul:fix/cli-comment-verification-return

PiperOrigin-RevId: 900007299

Merge branch 'master' into fix/cli-comment-verification-return

Merge pull request #1457 from google:dependabot/github_actions/actions/cache-5.0.5

PiperOrigin-RevId: 899533563

Merge branch 'master' into fix/cli-comment-verification-return

Bump actions/cache from 5.0.4 to 5.0.5 (#1457)

Bumps [actions/cache](https://github.com/actions/cache) from 5.0.4 to 5.0.5.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/668228422ae6a00e4ad889ee87cd7109ec5666a7...27d5ce7f107fe9357f9df03efb73ab90386fccae)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 5.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Eugene Kliuchnikov <eustas.ru@gmail.com>

Merge branch 'master' into dependabot/github_actions/actions/cache-5.0.5

Bump mymindstorm/setup-emsdk from 15 to 16 (#1456)

Bumps [mymindstorm/setup-emsdk](https://github.com/mymindstorm/setup-emsdk) from 15 to 16.
- [Release notes](https://github.com/mymindstorm/setup-emsdk/releases)
- [Commits](https://github.com/mymindstorm/setup-emsdk/compare/667eb33f24e84e7f362c16d8d7fff0629a73e15e...4528d102f7230f0e7b276855c01ea1159be0e984)

---
updated-dependencies:
- dependency-name: mymindstorm/setup-emsdk
  dependency-version: '16'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Eugene Kliuchnikov <eustas.ru@gmail.com>

Bump actions/cache from 5.0.4 to 5.0.5

Bumps [actions/cache](https://github.com/actions/cache) from 5.0.4 to 5.0.5.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/668228422ae6a00e4ad889ee87cd7109ec5666a7...27d5ce7f107fe9357f9df03efb73ab90386fccae)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 5.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Bump step-security/harden-runner from 2.16.1 to 2.17.0 (#1455)

Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.16.1 to 2.17.0.
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](https://github.com/step-security/harden-runner/compare/fe104658747b27e96e4f7e80cd0a94068e53901d...f808768d1510423e83855289c910610ca9b43176)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Eugene Kliuchnikov <eustas.ru@gmail.com>

Merge pull request #1444 from robinwatts:master

PiperOrigin-RevId: 899489367

Bump actions/upload-artifact from 7.0.0 to 7.0.1 (#1454)

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Merge branch 'master' into fix/cli-comment-verification-return

Merge branch 'master' into master