NDDev-it-com · rldyourmnd · Aug 15, 2026 · Aug 15, 2026
@@ -130,7 +130,7 @@ jobs:
         env:
           CALLEE_REPOSITORY: ${{ job.workflow_repository }}
           CALLEE_SHA: ${{ job.workflow_sha }}
-          LOCK_SHA256: 56499b7af8bbd983954cf15cf51ee97ff6915332d3716ed53a1102fa60449cd0
+          LOCK_SHA256: e8fd018f0ce1d2f8f23d1fe9ce674e384e98e3fc1ac34386e2fa769fede16185
           PYTHON_VERSION: '3.13'
         run: |
           set -euo pipefail

@@ -2,6 +2,19 @@
 
 ## [Unreleased]
 
+- Update py7zr to 1.1.3, closing six advisories the Qt toolchain was already
+  carrying. Locking the closure made it visible to dependency review and OSV for
+  the first time, and both immediately failed on `py7zr==1.0.0`:
+  GHSA-q6rc-2cgv-63h7 (arbitrary file write), GHSA-gjrg-mpp7-g774 and
+  PYSEC-2026-2972 (decompression bomb), GHSA-h4gh-22qq-72r7 and PYSEC-2026-2973
+  (quadratic complexity denial of service), PYSEC-2026-2974. All fixed in 1.1.3.
+
+  The exposure was not introduced by locking — `uvx --with 'py7zr==1.0.0'`
+  installed exactly that version, and an arbitrary-file-write flaw in the library
+  aqtinstall uses to unpack Qt archives is the one that matters most. What
+  changed is that an uninventoried closure cannot be scanned, and this one now is:
+  twenty-seven packages, zero advisories.
+
 - Close the Qt toolchain's dependency graph. `qt-ci.yml` ran
   `uvx --from 'aqtinstall@3.3.0' --with 'py7zr==1.0.0'`, which pinned two names
   and left everything they pull unbounded: aqtinstall declares `bs4`,

@@ -254,8 +254,8 @@ entries:
     criticality: supporting
     status: runtime-proven
     evidence: "Fixture caller ran the default configure/build/test lanes against tests/fixtures/qt on ubuntu-latest and the observer accepted the receipt: four sections (build, configure, test, toolchain), one CTest test, Qt 6.8.3 resolved and installed, and aqtinstall(aqt) v3.3.0. Qt is installed by a pinned aqtinstall invoked directly, so the workflow reaches no action it does not pin and starts where full-SHA pinning is enforced; check_transitive_action_pins reports the tree clean. The version resolves to exactly one published release and the architecture to exactly one published architecture, both refusing to guess, and the install root is located by its own qmake rather than derived from the architecture name. Linux only: only ubuntu-latest has been run."
-    last_run: https://github.com/NDDev-it-com/ci-workflows/actions/runs/31855694582
-    proven_digest: 86abe2691551ed32d11364856e553460b7dbfd487082951aaa2878ca2da79bfd
+    last_run: https://github.com/NDDev-it-com/ci-workflows/actions/runs/31856452245
+    proven_digest: 4f9bafce81819aa4d7ef2dd315fca4cb22edc469002cf8efcbadfac818bce9ec
     waiver: null
   - workflow: .github/workflows/r-ci.yml
     criticality: supporting

@@ -18,19 +18,19 @@ tools:
       rather than resolved at run time. Pinning the two top-level names left
       everything they pull unbounded.
     lock: requirements-qt.txt
-    lock_sha256: "56499b7af8bbd983954cf15cf51ee97ff6915332d3716ed53a1102fa60449cd0"
+    lock_sha256: "e8fd018f0ce1d2f8f23d1fe9ce674e384e98e3fc1ac34386e2fa769fede16185"
   - id: py7zr
     name: py7zr
     homepage: https://github.com/miurahr/py7zr
     kind: cli
-    current_version: "1.0.0"
-    pin: "1.0.0"
+    current_version: "1.1.3"
+    pin: "1.1.3"
     used_by:
       - .github/workflows/qt-ci.yml
     last_verified: "2026-08-15"
     notes: aqtinstall's archive backend; locked in the same closure.
     lock: requirements-qt.txt
-    lock_sha256: "56499b7af8bbd983954cf15cf51ee97ff6915332d3716ed53a1102fa60449cd0"
+    lock_sha256: "e8fd018f0ce1d2f8f23d1fe9ce674e384e98e3fc1ac34386e2fa769fede16185"
   - id: actionlint
     name: actionlint
     homepage: "https://github.com/rhysd/actionlint"

@@ -9,4 +9,4 @@
 #   uv pip compile --generate-hashes --universal --python-version 3.13 \
 #       -o requirements-qt.txt requirements-qt.in
 aqtinstall==3.3.0
-py7zr==1.0.0
+py7zr==1.1.3
@@ -1,11 +1,11 @@
 # GENERATED by `uv pip compile --generate-hashes --universal --python-version 3.13 -o requirements-qt.txt requirements-qt.in`
 # Do not hand-edit. See requirements-qt.in for why this file exists.
 # This file was autogenerated by uv via the following command:
-#    uv pip compile --generate-hashes --universal --python-version 3.13 -o /tmp/qt-tools.txt /tmp/qt-tools.in
+#    uv pip compile --generate-hashes --universal --python-version 3.13 -o /tmp/qt2.txt requirements-qt.in
 aqtinstall==3.3.0 \
     --hash=sha256:9c7d85fbe7258be2d7d23fda33f8aff2e8b7536817255eaeaaf4226da8546a31 \
     --hash=sha256:e88dbd87226f276fdd5d05347a44578d390d93a7f176e9476fbda0a7c9635f69
-    # via -r /tmp/qt-tools.in
+    # via -r requirements-qt.in
 backports-zstd==1.6.0 ; python_full_version < '3.14' \
     --hash=sha256:0308990ffc998df3c7ed35276bde049728b5c3956203cae40d80893576a41459 \
     --hash=sha256:03b7c59c71f7a597e2bcb3f8368371e9a660a1bdf1c37afc1f1ad1496a013c19 \
@@ -93,7 +93,7 @@ backports-zstd==1.6.0 ; python_full_version < '3.14' \
     --hash=sha256:f8f5c1c7c69a4b00889e52d9304a918a5b49010f9645768eb5fd0ad404f790ba \
     --hash=sha256:fa305a84087e10d7a85e8a8a3dcba8cdbda4868f2180173b264b7b488fd37c55 \
     --hash=sha256:fbb746522ebfc11155f1cd688e2c48ef3d74125e38b63eabdaab068a055c3e88
-    # via pyzstd
+    # via py7zr
 beautifulsoup4==4.15.0 \
     --hash=sha256:288e3ca7d54b06f2ac191970bc275c1939cb46d450b255bf6718b04aa37ab4f7 \
     --hash=sha256:d6f88de62e1d4e38ecb1077eb9724cd0eff29d2a08ca16a401e9b9e93f117cf9
@@ -617,11 +617,11 @@ psutil==7.2.2 ; sys_platform != 'cygwin' \
     --hash=sha256:eed63d3b4d62449571547b60578c5b2c4bcccc5387148db46e0c2313dad0ee00 \
     --hash=sha256:fd04ef36b4a6d599bbdb225dd1d3f51e00105f6d48a28f006da7f9822f2606d8
     # via py7zr
-py7zr==1.0.0 \
-    --hash=sha256:6f42d2ff34c808e9026ad11b721c13b41b0673cf2b4e8f8fb34f9d65ae143dd1 \
-    --hash=sha256:f6bfee81637c9032f6a9f0eb045a4bfc7a7ff4138becfc42d7cb89b54ffbfef1
+py7zr==1.1.3 \
+    --hash=sha256:17934a35089e026dec6c72ee275d9b841e646881ef822d618e805c3006661d9a \
+    --hash=sha256:8d51894abb38355bf14881088bb97f01fe4cb5b14ebe22f66d6297668c7e1a74
     # via
-    #   -r /tmp/qt-tools.in
+    #   -r requirements-qt.in
     #   aqtinstall
 pybcj==1.0.8 \
     --hash=sha256:0074af187b1acce9e31717fc9aa42bc36b67f1a44088a8b44f4f4792af688ee6 \
@@ -727,68 +727,68 @@ pycryptodomex==3.23.0 \
     --hash=sha256:fdfac7cda115bca3a5abb2f9e43bc2fb66c2b65ab074913643803ca7083a79ea \
     --hash=sha256:febec69c0291efd056c65691b6d9a339f8b4bc43c6635b8699471248fe897fea
     # via py7zr
-pyppmd==1.2.0 \
-    --hash=sha256:011c813389476e84387599ad4aa834100e888c6608a6e7d6f07ea7cbac8a8e65 \
-    --hash=sha256:0354919ab0f4065d76c64ad0dc21f14116651a2124cf4915b96c4e76d9caf470 \
-    --hash=sha256:064307c7fec7bdf3da63f5e28c0f1c5cb5c9bf888c1b268c6df3c131391ab345 \
-    --hash=sha256:0877758ffa73b2e9d2f93b698e17336a4d8acab8d9a3d17cd7960aec08347387 \
-    --hash=sha256:0f07d5376e1f699d09fbb9139562e5b72a347100aecaa73b688fa08461b3c118 \
-    --hash=sha256:14ed0846c3bcee506555cd943db950d5787a6ffa1089e05deced010759ef1fe5 \
-    --hash=sha256:1a5f0b78d68620ffb51c46c34c9e0ec02c40bb68e903e6c3ce02870c528164af \
-    --hash=sha256:1f19285ae4dd20bb917c4fd177f0911847feb3abada91cec5fd5d9d5f1b9f3e0 \
-    --hash=sha256:2cd2694f43720fa1304c1fa31b8a1e7d80162f045e91569fb93473277c2747b8 \
-    --hash=sha256:30068ed6da301f6ba25219f96d828f3c3a80ca227647571d21c7704301e095e6 \
-    --hash=sha256:3674b5eba0e312b9af987ec7e6af59248f54db9a7f5ca63add5365d6c6639e9e \
-    --hash=sha256:38e3835a1951d18dd273000c870a4eb2804c20c400aa3c72231449f300cedf19 \
-    --hash=sha256:3ac0960d2d0a1738af3ca3f27c6ed6eead38518d77875a47b2b4aae90ae933f4 \
-    --hash=sha256:3caef2fb93a63d696b21e5ff72cb2955687b5dfcbed1938936334f9f7737fcd3 \
-    --hash=sha256:40bfa26fdb3332a6a8d90fe1f6e0d9f489505a014911b470d66f2f79caea6d61 \
-    --hash=sha256:416c15576924ff9d2852fbe53d162c946e0466ce79d8a03a058e6f09a54934f0 \
-    --hash=sha256:42c7c9050b44b713676d255f0c212b8ff5c0463821053960c89292cf6b6221cc \
-    --hash=sha256:4a25d8b2a71e0cc6f34475c36450e905586b13d0c88fb28471655c215f370908 \
-    --hash=sha256:4a3087d7ee6fc35db0bfecabd1df4615f2a9d58a56af61f5fc18b9ce2b379cbf \
-    --hash=sha256:4aa8ffca1727872923d2673045975bca571eb810cf14a21d048648da5237369b \
-    --hash=sha256:4b3249256f8a7ecdd36477f277b232a46ee2c8ca280b23faaeacb7f50cab949a \
-    --hash=sha256:5768bff11936047613bcb91ee466f21779efc24360bd7953bd338b32da88577a \
-    --hash=sha256:5f1ee49b88fd2e58a144b1ae0da9c2fe0dabc1962531da9475badbed6fba61fc \
-    --hash=sha256:5ff515c2c3544096fe524f341c244787d6449b36692d27131bf74d5075e5c83b \
-    --hash=sha256:625896f5da7038fe7145907b68b0b58f7c13b88ad6bbfdc1c20c05654c17fa6c \
-    --hash=sha256:69fe10feb24a92e673b68aca5d945564232d09e25a4e185899e0c657096ae695 \
-    --hash=sha256:6dc00f0ce9f79e1c1c87d9998220a714ab8216873b6c996776b88ab23efe05ac \
-    --hash=sha256:75b173bbc9164cdc6fb257d3480269cc26b1eb102ad72281a98cf90e0f7dc860 \
-    --hash=sha256:7e955de43991346d4ccb28a74fb4c80cadecf72a6724705301fe1adb569689fe \
-    --hash=sha256:86e252979fc5ae2492ebb46ed0eed0625a46a2cce519c4616b870eab58d77fb7 \
-    --hash=sha256:874f52eae03647b653aa34476f4e23c4c30458245c0eb7aa7fb290940abbd5b9 \
-    --hash=sha256:8b43e299310e27af5a4bc505bcc87d10cfc38ae28e5ed1f6a779d811705e5ad6 \
-    --hash=sha256:9095d8b098ce8cb5c1e404843a16e5167fb5bdebb4d6aed259d43dd2d73cfca3 \
-    --hash=sha256:91534eb8c9c0bff9d6c6ec5eb5119a583d31bb9f8cf208d5a925b4e2293c9a7b \
-    --hash=sha256:9b5c3284be4dccebb87d81c14b148c81e035356cd01a29889736c75672f6187d \
-    --hash=sha256:a5c03dd85da64a237c601dd690d8eb95951b7c2eef91b89e110eb208010c6035 \
-    --hash=sha256:a5c763f2e3a011d5e96dfa0195f38accce9a14d489725a3d3641a74addbb5b72 \
-    --hash=sha256:aa40c982d1df515cd4cb366d3e1ae95ce22f3c20e6b8b2d31aa492679f7ad78c \
-    --hash=sha256:abafffb3d5b292924eafd8214ad80487400cf358c4e9dc2ac6c21d2c651c5ee2 \
-    --hash=sha256:af9be87228cba6b543531260f44675a23b4a1527158a44162dce186157cb13d9 \
-    --hash=sha256:bc9dd8a6261152591a352d91e5e52c16b81fa760f64c361a7afb24a1f3b5e048 \
-    --hash=sha256:bec8abbf1edb0300c0a2e4f1bbad6a96154de3e507a2b054a0b1187f1c2e4982 \
-    --hash=sha256:bf26c2def22322135fbaaa3de3c0963062c1835bd43d595478e3a2a674466a1a \
-    --hash=sha256:c012c17a53b6d9744e0514b17b0c4169c5f21fb54b4db7a0119bc2d7b3fcc609 \
-    --hash=sha256:c577f3dadd514979255e9df6eb89a63409d0e91855bb8c0969ffcd67d5d4f124 \
-    --hash=sha256:c67196af6cfcc68e72a8fffbc332d743327bb9323cb7f3709e27185e743c7272 \
-    --hash=sha256:c76b8881fc087e70338b1cccd452bd12566206587a0d0d8266ba2833be902194 \
-    --hash=sha256:c98697fea3f3baf5ffc759fd41c766d708ff3fba7379776031077527873ce4ac \
-    --hash=sha256:c9d0f5a903045ee6b399f5fb308e192e39f8f1f551b61441a595676d95dc76ad \
-    --hash=sha256:cc04af92f1d26831ec96963439dfb27c96467b5452b94436a6af696649a121fd \
-    --hash=sha256:cff27496fd164b587f150abba9524cae81629adbd2e9472f09e7b2b24b2d4939 \
-    --hash=sha256:d28cc9febcf37f2ff08b9e25d472de529e8973119c0a3279603b1915c809dd45 \
-    --hash=sha256:d437881763ffd0d19079402f50e7f4aad5895e3cd5312d095edef0b32dac3aef \
-    --hash=sha256:d529c78382a2315db22c93e1c831231ee3fd2ad5a352f61496d72474558c6b00 \
-    --hash=sha256:dcdd5bf53f562af2a9be76739be69c9de080dfa59a4c4a8bcc4a163f9c5cb53e \
-    --hash=sha256:edc4fcd928bf6219bcddb8230a5830e33a35b684b16ca3e8d1357b17029a9ef7 \
-    --hash=sha256:f29dfb7aaf4b49ebc09d726fcdeabbce1cb21e9cf3a055244bb1384b8b51dd3b
-    # via py7zr
-pyzstd==0.19.1 \
-    --hash=sha256:267e2eb0de0291dfcb7ccfebc4ffe75b2f9d84e7007ac38844f6ccafc6dce081 \
-    --hash=sha256:36723d3c915b3981de9198d0a2c82b2f5fe3eaa36e4d8d586937830a8afc7d72
+pyppmd==1.3.1 \
+    --hash=sha256:011f845de195d60fe973a635a1f4be981b7d80f357a8acb1b2d83bdf5087c808 \
+    --hash=sha256:017a1e2903f1c3147a1046db486990d401e8a25eb52c320b1fc2fb3e7b83cbeb \
+    --hash=sha256:041f46fbeb0a59888c0a94d6b9a557c652935633a104be1c31c12de491b5f448 \
+    --hash=sha256:0d1cff657e85655c67426c29c90c78a6210148b207993e643fc351c72c60d188 \
+    --hash=sha256:0e64247618cb150d2909beb0137da3084fef1d3479b4cc73b5b47fda7611abf9 \
+    --hash=sha256:124a04aab6936ba011f9ad57067798c7f052fdb1848b0cc4318606eea55475e6 \
+    --hash=sha256:1826cbce9a2c944aa08df79310a7e6d4a61fd20636b6dff64a77ea4bc43da30f \
+    --hash=sha256:1bd6d179ad39b6191ca0cbe62fb9592f33f49277b4384ad7bc5eb0e6ca27ebee \
+    --hash=sha256:1e1985461219c30d4576070b7e2de718dbb6f32637d1e658d25f838dfda2a4bb \
+    --hash=sha256:1e503a28c9a275d31f24af9b735d2cca543b62f438b064e2833e9833e758bdbc \
+    --hash=sha256:20d9d1aa4d0f32118c8094c212c66b7af50e55f47e7c6dffa5f35a8ac391faca \
+    --hash=sha256:234489036a1758670655d1ceafd4caeb93b858bd4c0ca39686837d38aef044c0 \
+    --hash=sha256:23b83799f33f9a24577f22e092b0feecda8cd1ea33871ad8610a58629874f7bc \
+    --hash=sha256:27703f041ee96912a5410fd3ce31c5cde32f9323bd67f72f100bd960ee67bf13 \
+    --hash=sha256:2d77ed79662c32e2551748d59763cfe3dcd10855bf3495937e3d5e5917507818 \
+    --hash=sha256:33daa996ad5203c665c0b55aff6329817b2cb7fa95f2c33a2e83ed0121b400cb \
+    --hash=sha256:37b1883accf840cb0b711785d353f8548853a1401d381da007c0aec362f3ffac \
+    --hash=sha256:385e92c97c42e8a6f0bfc0e4acfc6c074cb1ba3a2f650f292696dd9f19e2e603 \
+    --hash=sha256:391b2bf76d7dc45b343781754d0b734dcbf539b92667986a343f5488c4bf9ca0 \
+    --hash=sha256:3b765ae21f7ed2f4ea8f32bfd9e3a4a8d738e73fc8f8dcddec9cbe2c898d60be \
+    --hash=sha256:3de62099ff2ca876c2d39bc547bcba6f7b878988663abd782a5bad4edac3bb44 \
+    --hash=sha256:3faa58ab2ebe3b13ec23b1904639d687fb727270d2962fd2d239ca00fd6eb865 \
+    --hash=sha256:3fb3708d7b2b38e2999385a2f02c8e68e0f5a364d94f94e475e2e8b09e9338fc \
+    --hash=sha256:44d25e7dede2abb614bc023fe87835365fdd5865981c2273b70bfad71b84db29 \
+    --hash=sha256:486dde2294ff9b30465ab5bb0f213b20bd5ac0e4adf21be801a1ceb29aa75d9d \
+    --hash=sha256:4b4edb3e9619fd0bc39c1a07eb03e8731db833a93b23134f36c7ef581a94b37a \
+    --hash=sha256:610f214f2405e27eb5a3dad7fa15f385cfc42141a01cda71995d9c1e0b09fab9 \
+    --hash=sha256:6a1f92b94635c23d85270bb26db25cc0db544e436af86efc1cf58302d71d5af1 \
+    --hash=sha256:76e4800aa67292b4cc80058fd29b39e02a5dded721af9fe5654f356ef24307f4 \
+    --hash=sha256:7d61bd01f25289b6ae54832db4254602fb0c6d105f6e6bf0aee39b803b698b98 \
+    --hash=sha256:7f8d6375b18b9c79127fee0885cfd52e2e983edb67041464309426571d38dcd4 \
+    --hash=sha256:806cf8d33606e44bf5ff5786c57891f57993f1eef1c763da3c58ea97de3a13c8 \
+    --hash=sha256:8966f26b91ba7cdff3cfec5512d39d1f8bf4a8dbb75c44085e33b564566fea66 \
+    --hash=sha256:89730cf026416ae2546c92738966ecf117c8176d52c229ad621a61c34643818b \
+    --hash=sha256:8e3bf8deef44f8e03612689a6067a4a3dd7e50d2ef00af4cf987c59b62ff3006 \
+    --hash=sha256:9512a8b39740923559c26eb16266bf8b70d4eab6ad27a9b39cd2465e60e0acfa \
+    --hash=sha256:985c8703b53e5f68fe17f653e96748d60b1f855676c852a6e67cd472eb853671 \
+    --hash=sha256:9de2cdcc3932e7c23a54beb48dfe1b5ab7b4aedd5ffaae1e4871bd213d630cb3 \
+    --hash=sha256:a3509b3f881409ebc5522942438108c48a78f8df88bcf3f9d907b74131b9431c \
+    --hash=sha256:aa820aac385ac4ee57160b26d92862c69d31c08f92272dbef05fe8e619cea8d1 \
+    --hash=sha256:ae81a14895498d9a23429d92114c98da478b74b8e33251527d7cff3e01c09de0 \
+    --hash=sha256:b49870c6d7194f6eb80f30335ca03596d153e02fcde2c222e4f1202ac25f7fcf \
+    --hash=sha256:b8b5c813e462c91048b88e2adfbcc0c69f2c905f70097001d32066f86f675bd4 \
+    --hash=sha256:b9d54cd59ce97f2ba57be1da91b3d874d129faca21c9565d7afec111f942e6a1 \
+    --hash=sha256:bd00522ddfcc292304577386b6c217758c0c10e1fb9ce7877ad7d3b7b821a808 \
+    --hash=sha256:c8c1ad39e7ebde71bf5a54cf61f489bf4790f1dd0beb70dc2e8f5ad3329d7ca7 \
+    --hash=sha256:ced527f08ade4408c1bfc5264e9f97ffac8d221c9d13eca4f35ec1ec0c7b6b2e \
+    --hash=sha256:d1683e6d1ba09e377e0ae02de3a518191a3d63ccdb0b6037c74e6ddf577b5644 \
+    --hash=sha256:d354d6e551d2630b0ac98f27e3ad63e86cdcac9ce2115b5dfe46e2c9d3f4e82c \
+    --hash=sha256:d3ff96671319318d941dd34300d641745048e8a3251b077bddf98652d6ddc513 \
+    --hash=sha256:de87f7acd575fb07a4ff42d41bcc071570fe759a36f345f1f54f574ecfccfc5b \
+    --hash=sha256:df8d84ab72381058a964ba66e5e81ed52dbd0b5ad734a5ef8353452983506098 \
+    --hash=sha256:e066cbf1d335fe20480cd8ecc10848ba78d99fe6d1e44ea00def48feaf46afdf \
+    --hash=sha256:e16593ba4ca0a85821ae698ef06847a52937662f5ce1b130c39cca2979a4e8cd \
+    --hash=sha256:e4d74fa0f3531e9dadc56e0ace41bce82d3c0babed47b3f224101dc0dbde7287 \
+    --hash=sha256:e773d8353b36f7e7973a43526993fb276b98a97839cb5dc8f4e6465ad873f41a \
+    --hash=sha256:e77f5a6770950d464b50da760d53e67bce308a3abc8e3bd51db620b3f8cf1fa8 \
+    --hash=sha256:e8d372d9fac382183e0371cf0c2d736b494b1857a1befe98d563342b1205265b \
+    --hash=sha256:ea53f71ac16e113599b8441a9d8b6dcd71cfdf15cdb33ba5151810b8e656c5ec \
+    --hash=sha256:f2770a4b777c0c5236b3d9294b7bf4bc15538c95d45b2079eb8ebc1298e62e37 \
+    --hash=sha256:fdf55aa6ee7aef492f6896464e7a5a528f8615bb9e435f55bc8dff226fcc8292
     # via py7zr
 requests==2.34.2 \
     --hash=sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0 \

@@ -176,5 +176,5 @@
     }
   ],
   "schema_version": 1,
-  "spec_sha256": "33f83c0adff3f8dade616afdd84979c8d24f44b0c87bcaaf375ea88110c52145"
+  "spec_sha256": "07e078ece0c848223ec5beb2a91407d1aea95e03abf00badb26bf0829f6f44e9"
 }
@@ -54,6 +54,6 @@ fixtures:
     toolchain:
       qt_version: '6.8.3'
       aqtinstall_version: '3.3.0'
-      py7zr_version: '1.0.0'
+      py7zr_version: '1.1.3'
       cmake_minimum: '3.21'
       cxx_standard: '17'