use constraints.txt to prevent any downgrades during pip install

.github/workflows/build.yml

@@ -420,7 +420,10 @@ jobs:
                                              cryptography
                "${PYTHON}" -m pip install --force-reinstall --no-deps cryptography*.whl
              fi
-             "${PYTHON}" -m pip install --upgrade -r requirements.txt ${PIP_ARGS}
+             # build constraints file to prevent downgrades of existing
+             # packages
+             "${PYTHON}" -m pip freeze | grep == | sed 's/==/>=/' > constraints.txt
+             "${PYTHON}" -m pip install --upgrade -c constraints.txt -r requirements.txt ${PIP_ARGS}
              "${PYTHON}" -m pip list
 
       - name: Install PyInstaller