[david-mendez1]

Jira: DLPX-100181 [Backport of DLPX-100127 to release] [CD - 2026.6.0.0] - CVE-2026-111497 on drgn

= Problem

Backport of delphix/sdb#363 (merged to develop as be87131) to release, for DLPX-100127.

The drgn wheel that dh_virtualenv installs into /opt/venvs/sdb bundles Brotli 1.0.6, which has a decoder buffer overflow (CVE-2026-111497). The Ubuntu libbrotli1 update does not reach the bundled copy, and the latest drgn 0.3.0 still bundles 1.0.6.

= Solution

Same change as #363, squashed from its two commits into one: after dh_virtualenv, debian/use-system-brotli replaces the bundled libbrotlicommon and libbrotlidec with symlinks to the system libraries, and debian/control requires libbrotli1 (>= 1.1.0-2ubuntu0.1) at build and run time. This is a clean cherry-pick: it applied to release without conflicts, and the diff against the merged #363 is empty. release and the parent of #363 are the same commit (7f3c2aa).

= Testing

Tested on develop as described in #363. Not yet built or tested on release. Whether the release build environment has libbrotli1 >= 1.1.0-2ubuntu0.1 is unchecked.

🤖 Generated with Claude Code

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.65%. Comparing base (7f3c2aa) to head (f5937e9).
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff            @@
##           release     #364   +/-   ##
========================================
  Coverage    76.65%   76.65%           
========================================
  Files           73       73           
  Lines         4558     4558           
  Branches       728      728           
========================================
  Hits          3494     3494           
  Misses         878      878           
  Partials       186      186           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.