fix(deps): pin libcurl to 8.22.0 for CVE-2026-19931

osx/before-install.sh

@@ -39,8 +39,10 @@ if [ -n "${GITHUB_PATH:-}" ]; then
   echo "$swig_prefix/bin" >> "$GITHUB_PATH"
 fi
 
-# Install pipx without upgrading python dependencies
-brew install --ignore-dependencies pipx || python3 -m pip install --user pipx
+# Install pipx without upgrading python dependencies. Runner images already ship it,
+# and `brew install` on a present-but-outdated pipx upgrades it (source build on
+# Intel), so only install when it is genuinely missing.
+command -v pipx >/dev/null 2>&1 || brew install --ignore-dependencies pipx || python3 -m pip install --user pipx
 
 # issue with libtool on macOS https://github.com/Homebrew/homebrew-core/issues/180040
 brew_retry reinstall libtool

shared/vcpkg-lock.json

@@ -1,5 +1,5 @@
 {
   "https://github.com/microsoft/vcpkg": {
-    "HEAD": "b46d9050a9d40d54d24cac3ef8d50402d421f598"
+    "HEAD": "1391150599c0b9dc6f2a3c79c50eff6c94b077d1"
   }
 }

shared/vcpkg.json

@@ -10,6 +10,11 @@
     {
       "name": "expat",
       "version": "2.7.5"
+    },
+    {
+      "name": "curl",
+      "version": "8.22.0",
+      "port-version": 1
     }
   ],
   "features": {