From 0094666a393276a94241a154f79ce5a5029a8c26 Mon Sep 17 00:00:00 2001
From: MaxRev <cmthea32@gmail.com>
Date: Tue, 13 Oct 2026 19:16:59 +0300
Subject: [PATCH 1/2] fix(deps): pin libcurl to 8.22.0 for CVE-2026-19931
 (#251)

Add a vcpkg override for curl 8.22.0#1 and move the manifest lock HEAD
to a vcpkg commit whose versions database contains it. The baseline is
unchanged, so curl is the only resolved package that changes.
---
 shared/vcpkg-lock.json | 2 +-
 shared/vcpkg.json      | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/shared/vcpkg-lock.json b/shared/vcpkg-lock.json
index 3489882d0..2d03bdc38 100644
--- a/shared/vcpkg-lock.json
+++ b/shared/vcpkg-lock.json
@@ -1,5 +1,5 @@
 {
   "https://github.com/microsoft/vcpkg": {
-    "HEAD": "b46d9050a9d40d54d24cac3ef8d50402d421f598"
+    "HEAD": "1391150599c0b9dc6f2a3c79c50eff6c94b077d1"
   }
 }
diff --git a/shared/vcpkg.json b/shared/vcpkg.json
index 8fbb6329f..e71723091 100644
--- a/shared/vcpkg.json
+++ b/shared/vcpkg.json
@@ -10,6 +10,11 @@
     {
       "name": "expat",
       "version": "2.7.5"
+    },
+    {
+      "name": "curl",
+      "version": "8.22.0",
+      "port-version": 1
     }
   ],
   "features": {

From 55b443b7d154dc33d883b6f09abb3f0f92b28c4c Mon Sep 17 00:00:00 2001
From: MaxRev <cmthea32@gmail.com>
Date: Tue, 13 Oct 2026 23:14:06 +0300
Subject: [PATCH 2/2] fix(ci): skip pipx install on macOS when the runner
 already has it

brew install on a present-but-outdated pipx upgrades it; on macos-15-intel
that is a source build that now fails, and the pip --user fallback is
blocked by PEP 668.
---
 osx/before-install.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/osx/before-install.sh b/osx/before-install.sh
index 83194c954..85b06fea5 100755
--- a/osx/before-install.sh
+++ b/osx/before-install.sh
@@ -39,8 +39,10 @@ if [ -n "${GITHUB_PATH:-}" ]; then
   echo "$swig_prefix/bin" >> "$GITHUB_PATH"
 fi
 
-# Install pipx without upgrading python dependencies
-brew install --ignore-dependencies pipx || python3 -m pip install --user pipx
+# Install pipx without upgrading python dependencies. Runner images already ship it,
+# and `brew install` on a present-but-outdated pipx upgrades it (source build on
+# Intel), so only install when it is genuinely missing.
+command -v pipx >/dev/null 2>&1 || brew install --ignore-dependencies pipx || python3 -m pip install --user pipx
 
 # issue with libtool on macOS https://github.com/Homebrew/homebrew-core/issues/180040
 brew_retry reinstall libtool