Pin liblzma to a non-compromised version

H-uru · Mar 29, 2024 · c36a915 · c36a915
1 parent 93d8c2c
commit c36a915
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/vcpkg.json b/vcpkg.json
@@ -41,6 +41,11 @@
         "name": "physx",
         "version": "4.1.2#6",
         "$comment": "Upstream vcpkg updated to PhysX 5, which drops support for several target platforms. Stick with 4.1.2 for now."
+      },
+      {
+        "name": "liblzma",
+        "version": "5.4.4",
+        "$comment": "liblzma & xz were compromised upstream: CVE-2024-3094."
       }
     ],
     "features": {