[devGregA]

What changes

A libbrotlidec that a Python wheel vendors was reported as the system decoder library, so its fix read "Update the system Brotli package (libbrotli1, brotli-libs, libbrotli or brotli)". An OS update never touches that copy. Pillow's pillow.libs/libbrotlidec-*.so.1.2.0 is the case people will hit first, since Pillow has no fixed release yet.

Such a copy is now a bundled-decoder finding with product python-wheel. The message names the package, and the fix says to upgrade it:

[VULNERABLE] /usr/local/lib/python3.14/site-packages/pillow.libs/libbrotlidec-7e5462ba.so.1.2.0
   brotli/bundled-decoder: Brotli decoder without the CVE-2026-111497 fix (vendored in the pillow Python package)
   fix: Upgrade the pillow Python package to a release whose wheel bundles Brotli 1.0.10, 1.1.1, 1.2.1 or later. Updating the system Brotli package does not change this copy.

Recognised layouts:

• <package>.libs/ from auditwheel (Linux) and delvewheel (Windows), which names the distribution
• <module>/.dylibs/ from delocate (macOS), which names the import package, so the fix says "the Python package that provides PIL"

Only paths inside site-packages, dist-packages or a .whl count, so a libtool .libs build directory and other system paths stay decoder-library. Verdicts are unchanged.

Testing

• New TestFile cases: Linux, macOS and wheel-member layouts (vulnerable and fixed), plus a libtool .libs directory and a foo.libs outside Python that must stay the system library.
• go vet ./..., go test -race ./..., 20 s fuzz of pins, and govulncheck ./... are clean.
• Real image: defectdojo/defectdojo-django:3.4.303-debian now reports the Pillow copy with the output above. The system library, Python Brotli and pycurl stay fixed.

🤖 Generated with Claude Code