Update brotli to 1.2.0

[mattleibow]

Summary

Update brotli from v1.0.9 to v1.2.0 to fix CVE-2025-6176.

Security

CVE-2025-6176 (HIGH 7.5): Denial of Service via decompression bomb. Specially crafted Brotli-compressed data can decompress to enormous sizes, exhausting memory.

Changes

• Updated externals/skia submodule to mono/skia@9041d954a1
• Updated cgmanifest.json with brotli 1.2.0

Testing

• macOS arm64 build: ✅ Passed
• Console tests: ✅ 5340 passed

Required skia PR

mono/skia#165

[github-actions]

Triage Summary

The label os/macOS will be applied indicating that the issue is relevant to macOS.

This issue is not a regression as it primarily concerns updating a library for security reasons rather than introducing new problems.

Additional remarks:

• The issue involves updating the Brotli library but does not have appropriate labels for build or related libraries.
• There are no specific labels available that reflect the issue's focus on the Brotli update.

Detailed Summary and Actions

Summary of the triage:

• The issue is related to an update of the Brotli library.
• The label os/macOS will be applied because the issue mentions successful tests on macOS arm64.
• There are no other relevant labels available for this issue, as it does not fit into the categories of build, documentation, or other specific libraries indicated.

Summary of the actions that will be performed:

Action	Item	Description
Apply Label	os/macOS	The issue mentions successful tests on macOS arm64, indicating it is relevant to macOS.

This entire triage process was automated by AI and mistakes may have been made. Please let us know so we can continue to improve.