Merge pull request H-uru#1578 from dpogue/xz-fix

Downgrade liblzma in vcpkg
colincornaby · Mar 29, 2024 · 21c036c · 21c036c
2 parents 93d8c2c + 98b8249
commit 21c036c
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 5 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -268,11 +268,8 @@ jobs:
               autoconf \
               automake \
               libtool \
-              nasm
-
-      # Workaround for missing distutils on macOS: https://github.com/actions/runner/issues/2958
-      - name: Install setuptools
-        run: sudo -H pip3 install setuptools
+              nasm \
+              python-setuptools
 
       - name: Setup NuGet
         run: |

diff --git a/vcpkg.json b/vcpkg.json
@@ -41,6 +41,11 @@
         "name": "physx",
         "version": "4.1.2#6",
         "$comment": "Upstream vcpkg updated to PhysX 5, which drops support for several target platforms. Stick with 4.1.2 for now."
+      },
+      {
+        "name": "liblzma",
+        "version": "5.4.4",
+        "$comment": "liblzma & xz were compromised upstream: CVE-2024-3094."
       }
     ],
     "features": {