Deps_builder: pydantic 2.11.7

As requested by @dr.sybren and approved by the admins

Also pydantics deps :

annotated-types 0.7.0
pydantic-core 2.33.2
typing-extensions 4.14.0
typing-inspection 0.4.1

these are installed as binary packages agreed upon with the admins

versions determined by just pip installing it and seeing what it dragged in.

as some of these are binary packages that will differ per platform, there will
be a per platform hash for some packages now unfortunately

Pull Request: https://projects.blender.org/blender/blender/pulls/140434

build_files/build_environment/CMakeLists.txt

@@ -75,6 +75,7 @@ include(cmake/cython.cmake)
 include(cmake/numpy.cmake)
 include(cmake/zstandard.cmake)
 include(cmake/python_site_packages.cmake)
+include(cmake/python_site_packages_binary.cmake)
 include(cmake/package_python.cmake)
 include(cmake/openimageio.cmake)
 include(cmake/usd.cmake)

build_files/build_environment/cmake/package_python.cmake

@@ -48,6 +48,7 @@ if(MSVC)
         external_python
         external_numpy
         external_python_site_packages
+        external_python_site_packages_binary
         external_zstandard
         external_cython
       OUTPUT
@@ -97,6 +98,7 @@ if(MSVC)
         external_python
         external_numpy
         external_python_site_packages
+        external_python_site_packages_binary
         external_zstandard
         external_cython
       OUTPUT

build_files/build_environment/cmake/python_binary_requirements.txt.in

@@ -0,0 +1 @@
+@PYTHON_BINARY_REQUIREMENTS_CONTENT@

build_files/build_environment/cmake/python_site_packages_binary.cmake

@@ -0,0 +1,28 @@
+# SPDX-FileCopyrightText: 2025 Blender Authors
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+configure_file(${CMAKE_SOURCE_DIR}/cmake/python_binary_requirements.txt.in ${CMAKE_BINARY_DIR}/python_binary_requirements.txt @ONLY)
+
+
+# `--require-hashes` accomplishes 2 things for us 
+#
+# - it forces us to supply hashses and versions for all packages installed protecting against supply chain attacks
+# - if during a version bump any deps gain additional deps, these won't be in our requirements file, thus miss the hashes for those deps
+#   and an error will occur alerting us to this situation. 
+
+ExternalProject_Add(external_python_site_packages_binary
+  DOWNLOAD_COMMAND ""
+  CONFIGURE_COMMAND ""
+  BUILD_COMMAND ""
+  PREFIX ${BUILD_DIR}/site_packages
+
+  INSTALL_COMMAND ${PYTHON_BINARY} -m pip install --no-cache-dir -r ${CMAKE_BINARY_DIR}/python_binary_requirements.txt
+  --require-hashes
+  --only-binary :all:
+)
+
+add_dependencies(
+  external_python_site_packages_binary
+  external_python
+)

build_files/build_environment/cmake/versions.cmake

@@ -396,6 +396,55 @@ set(OPENVDB_HOMEPAGE http://www.openvdb.org/)
 set(OPENVDB_LICENSE SPDX:MPL-2.0)
 set(OPENVDB_COPYRIGHT "Copyright Contributors to the OpenVDB Project")
 
+# ------------------------------------------------------------------------------
+# Python Binary Modules
+# as these are binary packages, and they will differ from platform to platform we will have to 
+# specify a hash per platform, this is cumberome but there's really no way around that. Hopefully 
+# these packages will not update too often. 
+
+set(PYDANTIC_VERSION 2.11.7)
+set(PYDANTIC_HASH_ANY sha256:dde5df002701f6de26248661f6835bbe296a47bf73990135c7d07ce741b9623b)
+
+set(ANNOTATED_TYPES_VERSION 0.7.0)
+set(ANNOTATED_TYPES_HASH_ANY sha256:1f02e8b43a8fbbc3f3e0d4f0f4bfc8131bcb4eebe8849b8e5c773f3a1c582a53)
+
+set(PYDANTIC_CORE_VERSION 2.33.2)
+set(PYDANTIC_CORE_HASH_WIN_X64 sha256:1e063337ef9e9820c77acc768546325ebe04ee38b08703244c1309cccc4f1bab)
+set(PYDANTIC_CORE_HASH_WIN_ARM sha256:6b99022f1d19bc32a4c2a0d544fc9a76e3be90f0b3f4af413f87d38749300e65)
+set(PYDANTIC_CORE_HASH_MAC_ARM sha256:e799c050df38a639db758c617ec771fd8fb7a5f8eaaa4b27b101f266b216a246)
+set(PYDANTIC_CORE_HASH_LNX_X64 sha256:881b21b5549499972441da4758d662aeea93f1923f953e9cbaff14b8b9565aef)
+
+set(TYPING_EXTENSIONS_VERSION 4.14.0)
+set(TYPING_EXTENSIONS_HASH_ANY sha256:a1514509136dd0b477638fc68d6a91497af5076466ad0fa6c338e44e359944af)
+
+set(TYPING_INSPECTION_VERSION 0.4.1)
+set(TYPING_INSPECTION_HASH_ANY sha256:389055682238f53b04f7badcb49b989835495a96700ced5dab2d8feae4b26f51)
+
+if(WIN32)
+  if(BLENDER_PLATFORM_ARM)
+    set(PYTHON_BINARY_PLATFORM WIN_ARM)
+  else()
+    set(PYTHON_BINARY_PLATFORM WIN_X64)
+  endif()
+elseif(APPLE)
+  set(PYTHON_BINARY_PLATFORM MAC_ARM)
+elseif(UNIX)
+  set(PYTHON_BINARY_PLATFORM LNX_X64)
+endif()
+
+#
+# This variable is used by configure_file inside python_site_packages_binary, arguably this could
+# likely belong more in that file than it does in versions.cmake, however, having it here keeps
+# all version related data in a single place. 
+#
+set(PYTHON_BINARY_REQUIREMENTS_CONTENT 
+"pydantic==${PYDANTIC_VERSION} --hash=${PYDANTIC_HASH_ANY}
+annotated-types==${ANNOTATED_TYPES_VERSION} --hash=${ANNOTATED_TYPES_HASH_ANY}
+pydantic-core==${PYDANTIC_CORE_VERSION} --hash=${PYDANTIC_CORE_HASH_${PYTHON_BINARY_PLATFORM}}
+typing-extensions==${TYPING_EXTENSIONS_VERSION} --hash=${TYPING_EXTENSIONS_HASH_ANY}
+typing-inspection==${TYPING_INSPECTION_VERSION} --hash=${TYPING_INSPECTION_HASH_ANY}
+")
+
 # ------------------------------------------------------------------------------
 # Python Modules