From 43555a61a3756670b32359b7238abafaa73a139a Mon Sep 17 00:00:00 2001 From: Danil Silantyev Date: Sat, 15 Aug 2026 06:25:09 +0500 Subject: [PATCH] fix(qt): update py7zr to 1.1.3, closing six advisories the toolchain carried Locking the Qt closure made it visible to dependency review and OSV for the first time, and both failed on py7zr==1.0.0: GHSA-q6rc-2cgv-63h7 arbitrary file write GHSA-gjrg-mpp7-g774 decompression bomb (also PYSEC-2026-2972) GHSA-h4gh-22qq-72r7 O(n^2) complexity DoS (also PYSEC-2026-2973) PYSEC-2026-2974 All fixed in 1.1.3. The exposure was not introduced by locking. `uvx --with 'py7zr==1.0.0'` installed exactly that version, and an arbitrary-file-write flaw in the library aqtinstall uses to unpack Qt archives is the one that matters most. What changed is that an uninventoried closure cannot be scanned, and this one now is: 27 packages, zero advisories. Re-proven by fixture run 31856452245 before the ledger was updated. --- .github/workflows/qt-ci.yml | 2 +- CHANGELOG.md | 13 +++ catalog/runtime-coverage.yml | 4 +- catalog/tools.yml | 8 +- requirements-qt.in | 2 +- requirements-qt.txt | 138 +++++++++++------------ tests/fixtures/sdk-runtime-manifest.json | 2 +- tests/fixtures/sdk-runtime-spec.yml | 2 +- 8 files changed, 92 insertions(+), 79 deletions(-) diff --git a/.github/workflows/qt-ci.yml b/.github/workflows/qt-ci.yml index d2819b4..c2664e7 100644 --- a/.github/workflows/qt-ci.yml +++ b/.github/workflows/qt-ci.yml @@ -130,7 +130,7 @@ jobs: env: CALLEE_REPOSITORY: ${{ job.workflow_repository }} CALLEE_SHA: ${{ job.workflow_sha }} - LOCK_SHA256: 56499b7af8bbd983954cf15cf51ee97ff6915332d3716ed53a1102fa60449cd0 + LOCK_SHA256: e8fd018f0ce1d2f8f23d1fe9ce674e384e98e3fc1ac34386e2fa769fede16185 PYTHON_VERSION: '3.13' run: | set -euo pipefail diff --git a/CHANGELOG.md b/CHANGELOG.md index a7092c6..69660a5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,19 @@ ## [Unreleased] +- Update py7zr to 1.1.3, closing six advisories the Qt toolchain was already + carrying. Locking the closure made it visible to dependency review and OSV for + the first time, and both immediately failed on `py7zr==1.0.0`: + GHSA-q6rc-2cgv-63h7 (arbitrary file write), GHSA-gjrg-mpp7-g774 and + PYSEC-2026-2972 (decompression bomb), GHSA-h4gh-22qq-72r7 and PYSEC-2026-2973 + (quadratic complexity denial of service), PYSEC-2026-2974. All fixed in 1.1.3. + + The exposure was not introduced by locking — `uvx --with 'py7zr==1.0.0'` + installed exactly that version, and an arbitrary-file-write flaw in the library + aqtinstall uses to unpack Qt archives is the one that matters most. What + changed is that an uninventoried closure cannot be scanned, and this one now is: + twenty-seven packages, zero advisories. + - Close the Qt toolchain's dependency graph. `qt-ci.yml` ran `uvx --from 'aqtinstall@3.3.0' --with 'py7zr==1.0.0'`, which pinned two names and left everything they pull unbounded: aqtinstall declares `bs4`, diff --git a/catalog/runtime-coverage.yml b/catalog/runtime-coverage.yml index ddfafe8..53281c6 100644 --- a/catalog/runtime-coverage.yml +++ b/catalog/runtime-coverage.yml @@ -254,8 +254,8 @@ entries: criticality: supporting status: runtime-proven evidence: "Fixture caller ran the default configure/build/test lanes against tests/fixtures/qt on ubuntu-latest and the observer accepted the receipt: four sections (build, configure, test, toolchain), one CTest test, Qt 6.8.3 resolved and installed, and aqtinstall(aqt) v3.3.0. Qt is installed by a pinned aqtinstall invoked directly, so the workflow reaches no action it does not pin and starts where full-SHA pinning is enforced; check_transitive_action_pins reports the tree clean. The version resolves to exactly one published release and the architecture to exactly one published architecture, both refusing to guess, and the install root is located by its own qmake rather than derived from the architecture name. Linux only: only ubuntu-latest has been run." - last_run: https://github.com/NDDev-it-com/ci-workflows/actions/runs/31855694582 - proven_digest: 86abe2691551ed32d11364856e553460b7dbfd487082951aaa2878ca2da79bfd + last_run: https://github.com/NDDev-it-com/ci-workflows/actions/runs/31856452245 + proven_digest: 4f9bafce81819aa4d7ef2dd315fca4cb22edc469002cf8efcbadfac818bce9ec waiver: null - workflow: .github/workflows/r-ci.yml criticality: supporting diff --git a/catalog/tools.yml b/catalog/tools.yml index d965c85..24a0a15 100644 --- a/catalog/tools.yml +++ b/catalog/tools.yml @@ -18,19 +18,19 @@ tools: rather than resolved at run time. Pinning the two top-level names left everything they pull unbounded. lock: requirements-qt.txt - lock_sha256: "56499b7af8bbd983954cf15cf51ee97ff6915332d3716ed53a1102fa60449cd0" + lock_sha256: "e8fd018f0ce1d2f8f23d1fe9ce674e384e98e3fc1ac34386e2fa769fede16185" - id: py7zr name: py7zr homepage: https://github.com/miurahr/py7zr kind: cli - current_version: "1.0.0" - pin: "1.0.0" + current_version: "1.1.3" + pin: "1.1.3" used_by: - .github/workflows/qt-ci.yml last_verified: "2026-08-15" notes: aqtinstall's archive backend; locked in the same closure. lock: requirements-qt.txt - lock_sha256: "56499b7af8bbd983954cf15cf51ee97ff6915332d3716ed53a1102fa60449cd0" + lock_sha256: "e8fd018f0ce1d2f8f23d1fe9ce674e384e98e3fc1ac34386e2fa769fede16185" - id: actionlint name: actionlint homepage: "https://github.com/rhysd/actionlint" diff --git a/requirements-qt.in b/requirements-qt.in index 54eda27..99f723a 100644 --- a/requirements-qt.in +++ b/requirements-qt.in @@ -9,4 +9,4 @@ # uv pip compile --generate-hashes --universal --python-version 3.13 \ # -o requirements-qt.txt requirements-qt.in aqtinstall==3.3.0 -py7zr==1.0.0 +py7zr==1.1.3 diff --git a/requirements-qt.txt b/requirements-qt.txt index e20527d..034dfbd 100644 --- a/requirements-qt.txt +++ b/requirements-qt.txt @@ -1,11 +1,11 @@ # GENERATED by `uv pip compile --generate-hashes --universal --python-version 3.13 -o requirements-qt.txt requirements-qt.in` # Do not hand-edit. See requirements-qt.in for why this file exists. # This file was autogenerated by uv via the following command: -# uv pip compile --generate-hashes --universal --python-version 3.13 -o /tmp/qt-tools.txt /tmp/qt-tools.in +# uv pip compile --generate-hashes --universal --python-version 3.13 -o /tmp/qt2.txt requirements-qt.in aqtinstall==3.3.0 \ --hash=sha256:9c7d85fbe7258be2d7d23fda33f8aff2e8b7536817255eaeaaf4226da8546a31 \ --hash=sha256:e88dbd87226f276fdd5d05347a44578d390d93a7f176e9476fbda0a7c9635f69 - # via -r /tmp/qt-tools.in + # via -r requirements-qt.in backports-zstd==1.6.0 ; python_full_version < '3.14' \ --hash=sha256:0308990ffc998df3c7ed35276bde049728b5c3956203cae40d80893576a41459 \ --hash=sha256:03b7c59c71f7a597e2bcb3f8368371e9a660a1bdf1c37afc1f1ad1496a013c19 \ @@ -93,7 +93,7 @@ backports-zstd==1.6.0 ; python_full_version < '3.14' \ --hash=sha256:f8f5c1c7c69a4b00889e52d9304a918a5b49010f9645768eb5fd0ad404f790ba \ --hash=sha256:fa305a84087e10d7a85e8a8a3dcba8cdbda4868f2180173b264b7b488fd37c55 \ --hash=sha256:fbb746522ebfc11155f1cd688e2c48ef3d74125e38b63eabdaab068a055c3e88 - # via pyzstd + # via py7zr beautifulsoup4==4.15.0 \ --hash=sha256:288e3ca7d54b06f2ac191970bc275c1939cb46d450b255bf6718b04aa37ab4f7 \ --hash=sha256:d6f88de62e1d4e38ecb1077eb9724cd0eff29d2a08ca16a401e9b9e93f117cf9 @@ -617,11 +617,11 @@ psutil==7.2.2 ; sys_platform != 'cygwin' \ --hash=sha256:eed63d3b4d62449571547b60578c5b2c4bcccc5387148db46e0c2313dad0ee00 \ --hash=sha256:fd04ef36b4a6d599bbdb225dd1d3f51e00105f6d48a28f006da7f9822f2606d8 # via py7zr -py7zr==1.0.0 \ - --hash=sha256:6f42d2ff34c808e9026ad11b721c13b41b0673cf2b4e8f8fb34f9d65ae143dd1 \ - --hash=sha256:f6bfee81637c9032f6a9f0eb045a4bfc7a7ff4138becfc42d7cb89b54ffbfef1 +py7zr==1.1.3 \ + --hash=sha256:17934a35089e026dec6c72ee275d9b841e646881ef822d618e805c3006661d9a \ + --hash=sha256:8d51894abb38355bf14881088bb97f01fe4cb5b14ebe22f66d6297668c7e1a74 # via - # -r /tmp/qt-tools.in + # -r requirements-qt.in # aqtinstall pybcj==1.0.8 \ --hash=sha256:0074af187b1acce9e31717fc9aa42bc36b67f1a44088a8b44f4f4792af688ee6 \ @@ -727,68 +727,68 @@ pycryptodomex==3.23.0 \ --hash=sha256:fdfac7cda115bca3a5abb2f9e43bc2fb66c2b65ab074913643803ca7083a79ea \ --hash=sha256:febec69c0291efd056c65691b6d9a339f8b4bc43c6635b8699471248fe897fea # via py7zr -pyppmd==1.2.0 \ - --hash=sha256:011c813389476e84387599ad4aa834100e888c6608a6e7d6f07ea7cbac8a8e65 \ - --hash=sha256:0354919ab0f4065d76c64ad0dc21f14116651a2124cf4915b96c4e76d9caf470 \ - --hash=sha256:064307c7fec7bdf3da63f5e28c0f1c5cb5c9bf888c1b268c6df3c131391ab345 \ - --hash=sha256:0877758ffa73b2e9d2f93b698e17336a4d8acab8d9a3d17cd7960aec08347387 \ - --hash=sha256:0f07d5376e1f699d09fbb9139562e5b72a347100aecaa73b688fa08461b3c118 \ - --hash=sha256:14ed0846c3bcee506555cd943db950d5787a6ffa1089e05deced010759ef1fe5 \ - --hash=sha256:1a5f0b78d68620ffb51c46c34c9e0ec02c40bb68e903e6c3ce02870c528164af \ - --hash=sha256:1f19285ae4dd20bb917c4fd177f0911847feb3abada91cec5fd5d9d5f1b9f3e0 \ - --hash=sha256:2cd2694f43720fa1304c1fa31b8a1e7d80162f045e91569fb93473277c2747b8 \ - --hash=sha256:30068ed6da301f6ba25219f96d828f3c3a80ca227647571d21c7704301e095e6 \ - --hash=sha256:3674b5eba0e312b9af987ec7e6af59248f54db9a7f5ca63add5365d6c6639e9e \ - --hash=sha256:38e3835a1951d18dd273000c870a4eb2804c20c400aa3c72231449f300cedf19 \ - --hash=sha256:3ac0960d2d0a1738af3ca3f27c6ed6eead38518d77875a47b2b4aae90ae933f4 \ - --hash=sha256:3caef2fb93a63d696b21e5ff72cb2955687b5dfcbed1938936334f9f7737fcd3 \ - --hash=sha256:40bfa26fdb3332a6a8d90fe1f6e0d9f489505a014911b470d66f2f79caea6d61 \ - --hash=sha256:416c15576924ff9d2852fbe53d162c946e0466ce79d8a03a058e6f09a54934f0 \ - --hash=sha256:42c7c9050b44b713676d255f0c212b8ff5c0463821053960c89292cf6b6221cc \ - --hash=sha256:4a25d8b2a71e0cc6f34475c36450e905586b13d0c88fb28471655c215f370908 \ - --hash=sha256:4a3087d7ee6fc35db0bfecabd1df4615f2a9d58a56af61f5fc18b9ce2b379cbf \ - --hash=sha256:4aa8ffca1727872923d2673045975bca571eb810cf14a21d048648da5237369b \ - --hash=sha256:4b3249256f8a7ecdd36477f277b232a46ee2c8ca280b23faaeacb7f50cab949a \ - --hash=sha256:5768bff11936047613bcb91ee466f21779efc24360bd7953bd338b32da88577a \ - --hash=sha256:5f1ee49b88fd2e58a144b1ae0da9c2fe0dabc1962531da9475badbed6fba61fc \ - --hash=sha256:5ff515c2c3544096fe524f341c244787d6449b36692d27131bf74d5075e5c83b \ - --hash=sha256:625896f5da7038fe7145907b68b0b58f7c13b88ad6bbfdc1c20c05654c17fa6c \ - --hash=sha256:69fe10feb24a92e673b68aca5d945564232d09e25a4e185899e0c657096ae695 \ - --hash=sha256:6dc00f0ce9f79e1c1c87d9998220a714ab8216873b6c996776b88ab23efe05ac \ - --hash=sha256:75b173bbc9164cdc6fb257d3480269cc26b1eb102ad72281a98cf90e0f7dc860 \ - --hash=sha256:7e955de43991346d4ccb28a74fb4c80cadecf72a6724705301fe1adb569689fe \ - --hash=sha256:86e252979fc5ae2492ebb46ed0eed0625a46a2cce519c4616b870eab58d77fb7 \ - --hash=sha256:874f52eae03647b653aa34476f4e23c4c30458245c0eb7aa7fb290940abbd5b9 \ - --hash=sha256:8b43e299310e27af5a4bc505bcc87d10cfc38ae28e5ed1f6a779d811705e5ad6 \ - --hash=sha256:9095d8b098ce8cb5c1e404843a16e5167fb5bdebb4d6aed259d43dd2d73cfca3 \ - --hash=sha256:91534eb8c9c0bff9d6c6ec5eb5119a583d31bb9f8cf208d5a925b4e2293c9a7b \ - --hash=sha256:9b5c3284be4dccebb87d81c14b148c81e035356cd01a29889736c75672f6187d \ - --hash=sha256:a5c03dd85da64a237c601dd690d8eb95951b7c2eef91b89e110eb208010c6035 \ - --hash=sha256:a5c763f2e3a011d5e96dfa0195f38accce9a14d489725a3d3641a74addbb5b72 \ - --hash=sha256:aa40c982d1df515cd4cb366d3e1ae95ce22f3c20e6b8b2d31aa492679f7ad78c \ - --hash=sha256:abafffb3d5b292924eafd8214ad80487400cf358c4e9dc2ac6c21d2c651c5ee2 \ - --hash=sha256:af9be87228cba6b543531260f44675a23b4a1527158a44162dce186157cb13d9 \ - --hash=sha256:bc9dd8a6261152591a352d91e5e52c16b81fa760f64c361a7afb24a1f3b5e048 \ - --hash=sha256:bec8abbf1edb0300c0a2e4f1bbad6a96154de3e507a2b054a0b1187f1c2e4982 \ - --hash=sha256:bf26c2def22322135fbaaa3de3c0963062c1835bd43d595478e3a2a674466a1a \ - --hash=sha256:c012c17a53b6d9744e0514b17b0c4169c5f21fb54b4db7a0119bc2d7b3fcc609 \ - --hash=sha256:c577f3dadd514979255e9df6eb89a63409d0e91855bb8c0969ffcd67d5d4f124 \ - --hash=sha256:c67196af6cfcc68e72a8fffbc332d743327bb9323cb7f3709e27185e743c7272 \ - --hash=sha256:c76b8881fc087e70338b1cccd452bd12566206587a0d0d8266ba2833be902194 \ - --hash=sha256:c98697fea3f3baf5ffc759fd41c766d708ff3fba7379776031077527873ce4ac \ - --hash=sha256:c9d0f5a903045ee6b399f5fb308e192e39f8f1f551b61441a595676d95dc76ad \ - --hash=sha256:cc04af92f1d26831ec96963439dfb27c96467b5452b94436a6af696649a121fd \ - --hash=sha256:cff27496fd164b587f150abba9524cae81629adbd2e9472f09e7b2b24b2d4939 \ - --hash=sha256:d28cc9febcf37f2ff08b9e25d472de529e8973119c0a3279603b1915c809dd45 \ - --hash=sha256:d437881763ffd0d19079402f50e7f4aad5895e3cd5312d095edef0b32dac3aef \ - --hash=sha256:d529c78382a2315db22c93e1c831231ee3fd2ad5a352f61496d72474558c6b00 \ - --hash=sha256:dcdd5bf53f562af2a9be76739be69c9de080dfa59a4c4a8bcc4a163f9c5cb53e \ - --hash=sha256:edc4fcd928bf6219bcddb8230a5830e33a35b684b16ca3e8d1357b17029a9ef7 \ - --hash=sha256:f29dfb7aaf4b49ebc09d726fcdeabbce1cb21e9cf3a055244bb1384b8b51dd3b - # via py7zr -pyzstd==0.19.1 \ - --hash=sha256:267e2eb0de0291dfcb7ccfebc4ffe75b2f9d84e7007ac38844f6ccafc6dce081 \ - --hash=sha256:36723d3c915b3981de9198d0a2c82b2f5fe3eaa36e4d8d586937830a8afc7d72 +pyppmd==1.3.1 \ + --hash=sha256:011f845de195d60fe973a635a1f4be981b7d80f357a8acb1b2d83bdf5087c808 \ + --hash=sha256:017a1e2903f1c3147a1046db486990d401e8a25eb52c320b1fc2fb3e7b83cbeb \ + --hash=sha256:041f46fbeb0a59888c0a94d6b9a557c652935633a104be1c31c12de491b5f448 \ + --hash=sha256:0d1cff657e85655c67426c29c90c78a6210148b207993e643fc351c72c60d188 \ + --hash=sha256:0e64247618cb150d2909beb0137da3084fef1d3479b4cc73b5b47fda7611abf9 \ + --hash=sha256:124a04aab6936ba011f9ad57067798c7f052fdb1848b0cc4318606eea55475e6 \ + --hash=sha256:1826cbce9a2c944aa08df79310a7e6d4a61fd20636b6dff64a77ea4bc43da30f \ + --hash=sha256:1bd6d179ad39b6191ca0cbe62fb9592f33f49277b4384ad7bc5eb0e6ca27ebee \ + --hash=sha256:1e1985461219c30d4576070b7e2de718dbb6f32637d1e658d25f838dfda2a4bb \ + --hash=sha256:1e503a28c9a275d31f24af9b735d2cca543b62f438b064e2833e9833e758bdbc \ + --hash=sha256:20d9d1aa4d0f32118c8094c212c66b7af50e55f47e7c6dffa5f35a8ac391faca \ + --hash=sha256:234489036a1758670655d1ceafd4caeb93b858bd4c0ca39686837d38aef044c0 \ + --hash=sha256:23b83799f33f9a24577f22e092b0feecda8cd1ea33871ad8610a58629874f7bc \ + --hash=sha256:27703f041ee96912a5410fd3ce31c5cde32f9323bd67f72f100bd960ee67bf13 \ + --hash=sha256:2d77ed79662c32e2551748d59763cfe3dcd10855bf3495937e3d5e5917507818 \ + --hash=sha256:33daa996ad5203c665c0b55aff6329817b2cb7fa95f2c33a2e83ed0121b400cb \ + --hash=sha256:37b1883accf840cb0b711785d353f8548853a1401d381da007c0aec362f3ffac \ + --hash=sha256:385e92c97c42e8a6f0bfc0e4acfc6c074cb1ba3a2f650f292696dd9f19e2e603 \ + --hash=sha256:391b2bf76d7dc45b343781754d0b734dcbf539b92667986a343f5488c4bf9ca0 \ + --hash=sha256:3b765ae21f7ed2f4ea8f32bfd9e3a4a8d738e73fc8f8dcddec9cbe2c898d60be \ + --hash=sha256:3de62099ff2ca876c2d39bc547bcba6f7b878988663abd782a5bad4edac3bb44 \ + --hash=sha256:3faa58ab2ebe3b13ec23b1904639d687fb727270d2962fd2d239ca00fd6eb865 \ + --hash=sha256:3fb3708d7b2b38e2999385a2f02c8e68e0f5a364d94f94e475e2e8b09e9338fc \ + --hash=sha256:44d25e7dede2abb614bc023fe87835365fdd5865981c2273b70bfad71b84db29 \ + --hash=sha256:486dde2294ff9b30465ab5bb0f213b20bd5ac0e4adf21be801a1ceb29aa75d9d \ + --hash=sha256:4b4edb3e9619fd0bc39c1a07eb03e8731db833a93b23134f36c7ef581a94b37a \ + --hash=sha256:610f214f2405e27eb5a3dad7fa15f385cfc42141a01cda71995d9c1e0b09fab9 \ + --hash=sha256:6a1f92b94635c23d85270bb26db25cc0db544e436af86efc1cf58302d71d5af1 \ + --hash=sha256:76e4800aa67292b4cc80058fd29b39e02a5dded721af9fe5654f356ef24307f4 \ + --hash=sha256:7d61bd01f25289b6ae54832db4254602fb0c6d105f6e6bf0aee39b803b698b98 \ + --hash=sha256:7f8d6375b18b9c79127fee0885cfd52e2e983edb67041464309426571d38dcd4 \ + --hash=sha256:806cf8d33606e44bf5ff5786c57891f57993f1eef1c763da3c58ea97de3a13c8 \ + --hash=sha256:8966f26b91ba7cdff3cfec5512d39d1f8bf4a8dbb75c44085e33b564566fea66 \ + --hash=sha256:89730cf026416ae2546c92738966ecf117c8176d52c229ad621a61c34643818b \ + --hash=sha256:8e3bf8deef44f8e03612689a6067a4a3dd7e50d2ef00af4cf987c59b62ff3006 \ + --hash=sha256:9512a8b39740923559c26eb16266bf8b70d4eab6ad27a9b39cd2465e60e0acfa \ + --hash=sha256:985c8703b53e5f68fe17f653e96748d60b1f855676c852a6e67cd472eb853671 \ + --hash=sha256:9de2cdcc3932e7c23a54beb48dfe1b5ab7b4aedd5ffaae1e4871bd213d630cb3 \ + --hash=sha256:a3509b3f881409ebc5522942438108c48a78f8df88bcf3f9d907b74131b9431c \ + --hash=sha256:aa820aac385ac4ee57160b26d92862c69d31c08f92272dbef05fe8e619cea8d1 \ + --hash=sha256:ae81a14895498d9a23429d92114c98da478b74b8e33251527d7cff3e01c09de0 \ + --hash=sha256:b49870c6d7194f6eb80f30335ca03596d153e02fcde2c222e4f1202ac25f7fcf \ + --hash=sha256:b8b5c813e462c91048b88e2adfbcc0c69f2c905f70097001d32066f86f675bd4 \ + --hash=sha256:b9d54cd59ce97f2ba57be1da91b3d874d129faca21c9565d7afec111f942e6a1 \ + --hash=sha256:bd00522ddfcc292304577386b6c217758c0c10e1fb9ce7877ad7d3b7b821a808 \ + --hash=sha256:c8c1ad39e7ebde71bf5a54cf61f489bf4790f1dd0beb70dc2e8f5ad3329d7ca7 \ + --hash=sha256:ced527f08ade4408c1bfc5264e9f97ffac8d221c9d13eca4f35ec1ec0c7b6b2e \ + --hash=sha256:d1683e6d1ba09e377e0ae02de3a518191a3d63ccdb0b6037c74e6ddf577b5644 \ + --hash=sha256:d354d6e551d2630b0ac98f27e3ad63e86cdcac9ce2115b5dfe46e2c9d3f4e82c \ + --hash=sha256:d3ff96671319318d941dd34300d641745048e8a3251b077bddf98652d6ddc513 \ + --hash=sha256:de87f7acd575fb07a4ff42d41bcc071570fe759a36f345f1f54f574ecfccfc5b \ + --hash=sha256:df8d84ab72381058a964ba66e5e81ed52dbd0b5ad734a5ef8353452983506098 \ + --hash=sha256:e066cbf1d335fe20480cd8ecc10848ba78d99fe6d1e44ea00def48feaf46afdf \ + --hash=sha256:e16593ba4ca0a85821ae698ef06847a52937662f5ce1b130c39cca2979a4e8cd \ + --hash=sha256:e4d74fa0f3531e9dadc56e0ace41bce82d3c0babed47b3f224101dc0dbde7287 \ + --hash=sha256:e773d8353b36f7e7973a43526993fb276b98a97839cb5dc8f4e6465ad873f41a \ + --hash=sha256:e77f5a6770950d464b50da760d53e67bce308a3abc8e3bd51db620b3f8cf1fa8 \ + --hash=sha256:e8d372d9fac382183e0371cf0c2d736b494b1857a1befe98d563342b1205265b \ + --hash=sha256:ea53f71ac16e113599b8441a9d8b6dcd71cfdf15cdb33ba5151810b8e656c5ec \ + --hash=sha256:f2770a4b777c0c5236b3d9294b7bf4bc15538c95d45b2079eb8ebc1298e62e37 \ + --hash=sha256:fdf55aa6ee7aef492f6896464e7a5a528f8615bb9e435f55bc8dff226fcc8292 # via py7zr requests==2.34.2 \ --hash=sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0 \ diff --git a/tests/fixtures/sdk-runtime-manifest.json b/tests/fixtures/sdk-runtime-manifest.json index 1f4afaf..4f93704 100644 --- a/tests/fixtures/sdk-runtime-manifest.json +++ b/tests/fixtures/sdk-runtime-manifest.json @@ -176,5 +176,5 @@ } ], "schema_version": 1, - "spec_sha256": "33f83c0adff3f8dade616afdd84979c8d24f44b0c87bcaaf375ea88110c52145" + "spec_sha256": "07e078ece0c848223ec5beb2a91407d1aea95e03abf00badb26bf0829f6f44e9" } diff --git a/tests/fixtures/sdk-runtime-spec.yml b/tests/fixtures/sdk-runtime-spec.yml index ed05ed0..95b0c02 100644 --- a/tests/fixtures/sdk-runtime-spec.yml +++ b/tests/fixtures/sdk-runtime-spec.yml @@ -54,6 +54,6 @@ fixtures: toolchain: qt_version: '6.8.3' aqtinstall_version: '3.3.0' - py7zr_version: '1.0.0' + py7zr_version: '1.1.3' cmake_minimum: '3.21' cxx_standard: '17'