Affected File: .github/actions/homescreen-build/action.yml
toyota-connected / ivi-homescreen-plugins / .github / actions / homescreen-build / action.yml
pip3 install --user absl-py jinja2 ply meson
Risk: No version pinning means any future breaking or malicious update to these PyPI packages would affect the build. Use a requirements.txt with pinned versions and hash verification.
Affected File: .github/actions/homescreen-build/action.yml
toyota-connected / ivi-homescreen-plugins / .github / actions / homescreen-build / action.yml
pip3 install --user absl-py jinja2 ply mesonRisk: No version pinning means any future breaking or malicious update to these PyPI packages would affect the build. Use a requirements.txt with pinned versions and hash verification.