From da44210dc5a92911d3c1be0bba9ec2746a07586e Mon Sep 17 00:00:00 2001 From: Daniel Markstedt Date: Tue, 4 Aug 2026 23:51:53 +0200 Subject: [PATCH] harden dependency installation with pip pin to specific python packages and force binary packages only to avoid risky script execution --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 92f1789..05d2fa9 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -550,7 +550,7 @@ jobs: with: python-version: '3.x' - name: Install Python Dependencies - run: pip install meson ninja + run: 'python -m pip install --only-binary :all: meson==1.7.2 ninja==1.11.1.4' - name: Prepare MSVC uses: bus1/cabuild/action/msdevshell@06ea2833eef61e9b0d0ce0d728416e617e4fb1fe # v1 with: