diff --git a/.devcontainer/postCreateCommand.sh b/.devcontainer/postCreateCommand.sh
index 19ae90e03a..e1f10f6bde 100755
--- a/.devcontainer/postCreateCommand.sh
+++ b/.devcontainer/postCreateCommand.sh
@@ -18,16 +18,16 @@ rm -f /home/vscode/.gitconfig
 # Fix issue related to CFFI version mismatch
 pip uninstall cffi -y
 sudo apt remove --purge -y python3-cffi
-pip install --no-cache-dir --force-reinstall --ignore-installed cffi
+pip install --only-binary :all: --no-cache-dir --force-reinstall --ignore-installed cffi
 
 # Upgrade pip
 python3 -m pip install --upgrade pip
 
 # Ensure the correct invoke is available
-pip3 install --ignore-installed --upgrade invoke Pillow
+pip3 install --only-binary :all: --ignore-installed --upgrade invoke Pillow
 
 # install base level packages
-pip3 install -Ur contrib/container/requirements.txt --require-hashes
+pip3 install --only-binary :all: -Ur contrib/container/requirements.txt --require-hashes
 
 # Run initial InvenTree server setup
 invoke update -s
diff --git a/.github/actions/setup/action.yaml b/.github/actions/setup/action.yaml
index f3ffaebee8..557ef680b6 100644
--- a/.github/actions/setup/action.yaml
+++ b/.github/actions/setup/action.yaml
@@ -65,15 +65,15 @@ runs:
         shell: bash
         run: |
           python3 -m pip install -U pip
-          pip3 install -U invoke wheel
-          pip3 install 'uv>=0.9.6'
+          pip3 install --only-binary :all: -U invoke wheel
+          pip3 install --only-binary :all: 'uv>=0.9.6'
       - name: Allow uv to use the system Python by default
         run: echo "UV_SYSTEM_PYTHON=1" >> $GITHUB_ENV
         shell: bash
       - name: Install Specific Python Dependencies
         if: ${{ inputs.pip-dependency }}
         shell: bash
-        run: uv pip install ${PIP_DEPS}
+        run: "uv pip install ${PIP_DEPS}" # TODO remove building once mysqlclient is available as a wheel
         env:
           PIP_DEPS: ${{ inputs.pip-dependency }}
 
diff --git a/.github/workflows/check_translations.yaml b/.github/workflows/check_translations.yaml
index 44381efddf..86345e5f39 100644
--- a/.github/workflows/check_translations.yaml
+++ b/.github/workflows/check_translations.yaml
@@ -36,7 +36,7 @@ jobs:
           persist-credentials: false
 
       - name: Environment Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
         with:
           install: true
           apt-dependency: gettext
diff --git a/.github/workflows/frontend.yaml b/.github/workflows/frontend.yaml
index b869ec0954..2a488f08a2 100644
--- a/.github/workflows/frontend.yaml
+++ b/.github/workflows/frontend.yaml
@@ -73,11 +73,11 @@ jobs:
         with:
           persist-credentials: false
       - name: Environment Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
         with:
           npm: true
       - name: Install dependencies
-        run: cd src/frontend && yarn install
+        run: cd src/frontend && yarn install --ignore-scripts
       - name: Build frontend
         run: cd src/frontend && yarn run compile && yarn run lib && yarn run build
       - name: Write version file - SHA
@@ -127,13 +127,13 @@ jobs:
         with:
           persist-credentials: false
       - name: Environment Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
         with:
           npm: true
           install: true
           update: true
           apt-dependency: gettext postgresql-client libpq-dev
-          pip-dependency: psycopg2
+          pip-dependency: psycopg
       - name: Set up test data
         run: |
           invoke dev.setup-test -iv
@@ -148,10 +148,10 @@ jobs:
           key: ${{ runner.os }}-playwright-${{ hashFiles('src/frontend/yarn.lock') }}
       - name: Install Playwright browsers
         if: steps.playwright-cache.outputs.cache-hit != 'true'
-        run: cd src/frontend && npx playwright install --with-deps
+        run: cd src/frontend && npx --ignore-scripts playwright install --with-deps
       - name: Install Playwright OS dependencies
         if: steps.playwright-cache.outputs.cache-hit == 'true'
-        run: cd src/frontend && npx playwright install-deps
+        run: cd src/frontend && npx --ignore-scripts playwright install-deps
       - name: Install Sample Plugin
         run: |
           pip install -U inventree-plugin-creator==${{ env.plugin_creator_version }}
@@ -164,7 +164,7 @@ jobs:
           cp ./tests/fixtures/playwright_custom_logo.png ../backend/InvenTree/InvenTree/static/img/playwright_custom_logo.png
           cp ./tests/fixtures/playwright_custom_splash.png ../backend/InvenTree/InvenTree/static/img/playwright_custom_splash.png
           invoke static
-          env INVENTREE_CUSTOM_SPLASH="img/playwright_custom_splash.png" INVENTREE_CUSTOM_LOGO="img/playwright_custom_logo.png" PLAYWRIGHT_BASE_URL=http://localhost:8000 npx playwright test --project=firefox --shard=${{ matrix.shard }}/2
+           env INVENTREE_CUSTOM_SPLASH="img/playwright_custom_splash.png" INVENTREE_CUSTOM_LOGO="img/playwright_custom_logo.png" PLAYWRIGHT_BASE_URL=http://localhost:8000 npx --ignore-scripts playwright test --project=firefox --shard=${{ matrix.shard }}/2
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: ${{ !cancelled() && steps.tests.outcome == 'failure' }}
         with:
@@ -209,13 +209,13 @@ jobs:
         with:
           persist-credentials: false
       - name: Environment Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
         with:
           npm: true
           install: true
           update: true
           apt-dependency: gettext postgresql-client libpq-dev
-          pip-dependency: psycopg2
+          pip-dependency: psycopg
       - name: Set up test data
         run: |
           invoke dev.setup-test -iv
@@ -230,10 +230,10 @@ jobs:
           key: ${{ runner.os }}-playwright-${{ hashFiles('src/frontend/yarn.lock') }}
       - name: Install Playwright browsers
         if: steps.playwright-cache.outputs.cache-hit != 'true'
-        run: cd src/frontend && npx playwright install --with-deps
+        run: cd src/frontend && npx --ignore-scripts playwright install --with-deps
       - name: Install Playwright OS dependencies
         if: steps.playwright-cache.outputs.cache-hit == 'true'
-        run: cd src/frontend && npx playwright install-deps
+        run: cd src/frontend && npx --ignore-scripts playwright install-deps
       - name: Install Sample Plugin
         run: |
           pip install -U inventree-plugin-creator==${{ env.plugin_creator_version }}
@@ -243,7 +243,7 @@ jobs:
         id: tests
         run: |
           cd src/frontend
-          npx nyc playwright test --project=chromium --shard=${{ matrix.shard }}/4
+          npx --ignore-scripts nyc playwright test --project=chromium --shard=${{ matrix.shard }}/4
       - name: Playwright Report [${{ matrix.shard }} / 4]
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: ${{ !cancelled() && steps.tests.outcome == 'failure' }}
@@ -278,7 +278,7 @@ jobs:
           persist-credentials: false
 
       - name: Environment Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
         with:
           npm: true
           install: false
@@ -295,8 +295,8 @@ jobs:
         run: |
           mkdir -p .nyc_output
           cp all-coverage/*.json .nyc_output/ 2>/dev/null || true
-          npx nyc merge .nyc_output merged-coverage.json
-          npx nyc report \
+          npx --ignore-scripts nyc merge .nyc_output merged-coverage.json
+          npx --ignore-scripts nyc report \
             --tempdir .nyc_output \
             --reporter=lcov \
             --reporter=text-summary \
diff --git a/.github/workflows/import_export.yaml b/.github/workflows/import_export.yaml
index ca261382bd..b984533d89 100644
--- a/.github/workflows/import_export.yaml
+++ b/.github/workflows/import_export.yaml
@@ -82,7 +82,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Environment Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
         with:
           apt-dependency: gettext poppler-utils libpq-dev
           pip-dependency: psycopg
@@ -154,7 +154,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Environment Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
         with:
           apt-dependency: gettext poppler-utils libpq-dev
           pip-dependency: psycopg
@@ -218,7 +218,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Environment Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
         with:
           apt-dependency: gettext poppler-utils libpq-dev
           pip-dependency: psycopg
@@ -292,7 +292,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Environment Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
         with:
           apt-dependency: gettext poppler-utils libpq-dev
           pip-dependency: psycopg
diff --git a/.github/workflows/migration_tests.yaml b/.github/workflows/migration_tests.yaml
index 5a03a5aa46..dfa1d7748b 100644
--- a/.github/workflows/migration_tests.yaml
+++ b/.github/workflows/migration_tests.yaml
@@ -67,7 +67,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Environment Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
         with:
           apt-dependency: gettext poppler-utils
           dev-install: true
@@ -117,7 +117,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Environment Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
         with:
           apt-dependency: gettext poppler-utils libmysqlclient-dev
           pip-dependency: mysqlclient
@@ -164,7 +164,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Environment Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
         with:
           apt-dependency: gettext poppler-utils libpq-dev
           pip-dependency: psycopg
@@ -199,7 +199,7 @@ jobs:
           persist-credentials: false
         name: Checkout Code
       - name: Environment Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
         with:
           install: true
       - name: Fetch Database
diff --git a/.github/workflows/qc_checks.yaml b/.github/workflows/qc_checks.yaml
index bd8d16fb50..8bdc69bd37 100644
--- a/.github/workflows/qc_checks.yaml
+++ b/.github/workflows/qc_checks.yaml
@@ -129,7 +129,7 @@ jobs:
           persist-credentials: false
       - name: Environment Setup
         id: setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
         with:
           apt-dependency: gettext poppler-utils
           dev-install: true
@@ -188,7 +188,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Environment Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
         with:
           apt-dependency: gettext poppler-utils
           dev-install: true
@@ -330,7 +330,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Environment Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
         with:
           apt-dependency: gettext poppler-utils
           dev-install: true
@@ -388,7 +388,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Environment Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
         with:
           apt-dependency: gettext poppler-utils
           dev-install: true
@@ -441,7 +441,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Environment Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
         with:
           apt-dependency: gettext poppler-utils
           dev-install: true
@@ -492,7 +492,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Environment Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
         with:
           apt-dependency: gettext poppler-utils libpq-dev
           pip-dependency: psycopg django-redis>=5.0.0
@@ -541,7 +541,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Environment Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
         with:
           apt-dependency: gettext poppler-utils libmysqlclient-dev
           pip-dependency: mysqlclient
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 8205cb574e..6a2fab0e67 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -25,7 +25,7 @@ jobs:
           persist-credentials: false
       - name: Version Check
         run: |
-          pip install --require-hashes -r contrib/dev_reqs/requirements.txt
+          pip install --require-hashes --only-binary :all: -r contrib/dev_reqs/requirements.txt
           python3 .github/scripts/version_check.py
       - name: Push to Stable Branch
         uses: ad-m/github-push-action@881a6320fdb16eb5318c5054f31c218aec2b324c # v1.3.0
@@ -49,7 +49,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Environment Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
         with:
           npm: true
       - name: Install dependencies
@@ -119,14 +119,14 @@ jobs:
         with:
           persist-credentials: false
       - name: Environment Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
         with:
           install: true
           npm: true
       - name: Install dependencies
         run: |
-          pip install --require-hashes -r contrib/dev_reqs/requirements.txt
-          pip install --require-hashes -r docs/requirements.txt
+          pip install --require-hashes --only-binary :all: -r contrib/dev_reqs/requirements.txt
+          pip install --require-hashes --only-binary :all: -r docs/requirements.txt
       - name: Build documentation
         run: |
           invoke build-docs --mkdocs
@@ -213,7 +213,7 @@ jobs:
           echo "#!/bin/bash" > contrib/packager.io/before.sh
 
           echo "calculate release channel"
-          pip install --require-hashes -r contrib/dev_reqs/requirements.txt
+          pip install --require-hashes --only-binary :all: -r contrib/dev_reqs/requirements.txt
           python3 .github/scripts/version_check.py
       - name: cleanup
         run: |
@@ -222,7 +222,7 @@ jobs:
           # remove the whole docs dir - we are not doing anything with them
           rm -rf docs
       - name: Package - current release channel
-        uses: pkgr/action/package@c5666febcd31750da6428042193fc5b2fb765435 # main
+        uses: pkgr/action/package@c5666febcd31750da6428042193fc5b2fb765435 # v1.0.2
         id: package
         with:
           name: inventree
@@ -241,7 +241,7 @@ jobs:
             INVENTREE_CONFIG_FILE=/opt/inventree/config.yaml
             APP_REPO=inventree/InvenTree
       - name: Publish to go.packager.io - current release channel
-        uses: pkgr/action/publish@c5666febcd31750da6428042193fc5b2fb765435 # main
+        uses: pkgr/action/publish@c5666febcd31750da6428042193fc5b2fb765435 # v1.0.2
         with:
           target: ${{ matrix.target }}
           token: ${{ secrets.PACKAGER_RELEASE_TOKEN }}
@@ -256,7 +256,7 @@ jobs:
           PACKAGE_NAME: ${{ matrix.target }}-${{ steps.setup.outputs.version }}.tar.gz
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Package - stable release channel
-        uses: pkgr/action/package@c5666febcd31750da6428042193fc5b2fb765435 # main
+        uses: pkgr/action/package@c5666febcd31750da6428042193fc5b2fb765435 # v1.0.2
         id: package-stable
         with:
           name: inventree
@@ -275,7 +275,7 @@ jobs:
             INVENTREE_CONFIG_FILE=/opt/inventree/config.yaml
             APP_REPO=inventree/InvenTree
       - name: Publish to go.packager.io - stable release channel
-        uses: pkgr/action/publish@c5666febcd31750da6428042193fc5b2fb765435 # main
+        uses: pkgr/action/publish@c5666febcd31750da6428042193fc5b2fb765435 # v1.0.2
         with:
           target: ${{ matrix.target }}
           token: ${{ secrets.PACKAGER_RELEASE_TOKEN }}
diff --git a/.github/workflows/translations.yaml b/.github/workflows/translations.yaml
index 358f21cd9b..63e01a31fe 100644
--- a/.github/workflows/translations.yaml
+++ b/.github/workflows/translations.yaml
@@ -36,7 +36,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Environment Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
         with:
           install: true
           apt-dependency: gettext
diff --git a/contrib/packager.io/before.sh b/contrib/packager.io/before.sh
index 0da421fd38..3ed395d08b 100755
--- a/contrib/packager.io/before.sh
+++ b/contrib/packager.io/before.sh
@@ -11,17 +11,17 @@ SHA=$(echo $APP_PKG_ITERATION | cut -d'.' -f2)
 
 # Download info
 echo "INFO collection | Getting info from github for commit $SHA"
-curl -L -s -f \
+curl -L -s -f --proto "=https" \
   -H "Accept: application/vnd.github+json" \
   -H "X-GitHub-Api-Version: 2022-11-28" \
   https://api.github.com/repos/$APP_REPO/commits/$SHA > commit.json
 echo "INFO collection | Got commit.json with size $(wc -c commit.json)"
-curl -L -s -f \
+curl -L -s -f --proto "=https" \
   -H "Accept: application/vnd.github+json" \
   -H "X-GitHub-Api-Version: 2022-11-28" \
   https://api.github.com/repos/$APP_REPO/commits/$SHA/branches-where-head > branches.json
 echo "INFO collection | Got branches.json with size $(wc -c branches.json)"
-curl -L -s -f \
+curl -L -s -f --proto "=https" \
   -H "Accept: application/vnd.github+json" \
   -H "X-GitHub-Api-Version: 2022-11-28" \
   https://api.github.com/repos/$APP_REPO/commits/$APP_PKG_VERSION > tag.json
@@ -59,7 +59,7 @@ if [ "$TAG_SHA" != "$FULL_SHA" ]; then
   echo "INFO frontend | Tag sha '$TAG_SHA' is not the same as commit sha $FULL_SHA, can not download frontend"
 else
   echo "INFO frontend | Getting frontend from github via tag"
-  curl https://github.com/$APP_REPO/releases/download/$APP_PKG_VERSION/frontend-build.zip -L -O -f
+  curl https://github.com/$APP_REPO/releases/download/$APP_PKG_VERSION/frontend-build.zip -L -O -f --proto "=https"
   mkdir -p src/backend/InvenTree/web/static
   echo "INFO frontend | Unzipping frontend"
   unzip -qq frontend-build.zip -d src/backend/InvenTree/web/static/web