Oh, interesting: git https remote (git-remote-https) may be vulnerable to the #brotli RCE (CVE-2026-111497), if built with brotli-enabled libcurl. I'm guessing updating libbrotli would fix that, but that seems like a neat, little attack vector that flies under the radar.