📌📦 Pin pkginfo to v1.12 @ runtime deps

Signed-off-by: William Woodruff <william@trailofbits.com>

requirements/runtime.in

@@ -1,5 +1,10 @@
 twine ~= 6.0
 
+# NOTE: 1.12.0 and later enable support for metadata 2.4
+# NOTE: This can be dropped once twine stops using pkginfo
+# Ref: https://github.com/pypa/twine/pull/1180
+pkginfo ~= 1.12.0
+
 # NOTE: Used to detect an ambient OIDC credential for OIDC publishing,
 # NOTE: as well as PEP 740 attestations.
 id ~= 1.0

requirements/runtime.txt

@@ -66,8 +66,10 @@ packaging==24.1
     #   -r runtime.in
     #   pypi-attestations
     #   twine
-pkginfo==1.10.0
-    # via twine
+pkginfo==1.12.0
+    # via
+    #   -r runtime.in
+    #   twine
 platformdirs==4.2.2
     # via sigstore
 pyasn1==0.6.0