From dd3e6c722bf188d66316cd63e2c0c9c5d59948e8 Mon Sep 17 00:00:00 2001
From: Ckuma <mehdy@psydev.org>
Date: Wed, 17 Jun 2026 14:01:56 -0400
Subject: [PATCH] Pin build and runtime dependencies for reproducible,
 CVE-clean releases

Issue #5 shipped a broken Linux build because the unpinned PyInstaller
version installed at release time did not bundle PIL._tkinter_finder.
Pin the toolchain so a release can no longer silently regress on version
drift, and lock runtime deps to audited, vulnerability-free versions.

- pyinstaller==6.21.0 (CI build jobs + build_exe.bat)
- pillow==12.2.0 (pillow<12.2.0 has 12 known CVEs, incl. ImageMath.eval
  RCE CVE-2023-50447 and libwebp heap overflow CVE-2023-4863)
- python-dateutil==2.9.0.post0, ttkbootstrap==1.20.3

All verified clean with pip-audit (OSV / PyPI advisory DB).
---
 .github/workflows/build.yml | 4 ++--
 python/build_exe.bat        | 2 +-
 python/requirements.txt     | 9 ++++++---
 3 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 2097f46..75d3cf7 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -57,7 +57,7 @@ jobs:
         run: |
           python -m pip install --upgrade pip
           pip install -r requirements.txt
-          pip install pyinstaller
+          pip install pyinstaller==6.21.0
 
       - name: Build executable
         working-directory: python
@@ -97,7 +97,7 @@ jobs:
         run: |
           python -m pip install --upgrade pip
           pip install -r requirements.txt
-          pip install pyinstaller
+          pip install pyinstaller==6.21.0
 
       - name: Build executable
         working-directory: python
diff --git a/python/build_exe.bat b/python/build_exe.bat
index 665a131..ad4395d 100644
--- a/python/build_exe.bat
+++ b/python/build_exe.bat
@@ -50,7 +50,7 @@ if errorlevel 1 (
 
 :: Install PyInstaller if needed
 echo [INFO] Checking PyInstaller...
-pip install pyinstaller --quiet
+pip install pyinstaller==6.21.0 --quiet
 if errorlevel 1 (
     echo [ERROR] Failed to install PyInstaller
     goto :error
diff --git a/python/requirements.txt b/python/requirements.txt
index 5d6c83b..6cd3e4c 100644
--- a/python/requirements.txt
+++ b/python/requirements.txt
@@ -1,3 +1,6 @@
-python-dateutil>=2.8.0
-pillow>=9.0.0
-ttkbootstrap>=1.10.0
+# Pinned for reproducible, CVE-clean release builds.
+# pillow<12.2.0 carries known CVEs (incl. ImageMath.eval RCE CVE-2023-50447,
+# libwebp heap overflow CVE-2023-4863); see CVE audit before bumping.
+python-dateutil==2.9.0.post0
+pillow==12.2.0
+ttkbootstrap==1.20.3