[Backport release-25.05] pixi: 0.46.0 -> 0.59.0

[mdaniels5757]

Manual backport of many PRs, including #456779 (which has security fixes).

Things done

• Built on platform:
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• Tested, as applicable:
  • NixOS tests in nixos/tests.
  • Package tests at passthru.tests.
  • Tests in lib/tests or pkgs/test for functions and "core" functionality.
• Ran nixpkgs-review on this PR. See nixpkgs-review usage.
• Tested basic functionality of all binary files, usually in ./result/bin/.
• Nixpkgs Release Notes
  • Package update: when the change is major or breaking.
• NixOS Release Notes
  • Module addition: when adding a new NixOS module.
  • Module update: when the change is significant.
• Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other READMEs.

---

Add a 👍 reaction to pull requests you find important.

[mdaniels5757]

nixpkgs-review result

Generated using nixpkgs-review-gha

Command: nixpkgs-review pr 457576
Commit: b0a318e26de9d8f3b04449cd038d9e95e72d749a (subsequent changes)
Merge: 7568b8672d08054d89ffa1dd2d30ec1405f3649d

Logs: https://github.com/mdaniels5757/nixpkgs-review-gha/actions/runs/18999774205

---

x86_64-linux

✅ 1 package built:

• pixi

---

aarch64-linux

✅ 1 package built:

• pixi

---

x86_64-darwin (sandbox = true)

✅ 1 package built:

• pixi

---

aarch64-darwin (sandbox = true)

✅ 1 package built:

• pixi

[LeSuisse]

There are breaking changes in some of these releases. Can we only pull the dependency bump or craft a patch?

https://github.com/prefix-dev/pixi/releases/tag/v0.55.0
https://github.com/prefix-dev/pixi/releases/tag/v0.53.0
https://github.com/prefix-dev/pixi/releases/tag/v0.52.0
https://github.com/prefix-dev/pixi/releases/tag/v0.51.0

[mdaniels5757]

Can we only pull the dependency bump?

No, https://github.com/prefix-dev/pixi/commit/66efc2b35f2b375444d69355af96b2f8d509b6a1.patch won't apply.

Can we craft a patch?

I dunno, maybe? I can run cargo update for the this, and the other thing that cargo audit tells me are vulnerable (not including tracing-subscriber, which was not updated by upstream in prefix-dev/pixi#4491). But there are also packages that are unmaintained or yanked, and those can't be removed without updating, I think.

[LeSuisse]

The crates marked as unmaintained should be reasonable to keep.

I'm not against bumping to the latest version but I cannot evaluate if they can affect NixOS/nixpkgs users or not. We should not introduce breaking changes to our stable releases: https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#changes-acceptable-for-releases

Bumping the following 2 crates seems reasonable on 0.46.0:

• openssl: 0.10.71 -> 0.10.74 (RUSTSEC-2025-0022)
• astral-tokio-tar: 0.5.2 -> 0.5.6 (RUSTSEC-2025-0110)

diff --git a/Cargo.lock b/Cargo.lock
index 8db4baa4a..4a7bb82d4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -164,9 +164,9 @@ checksum = "9b34d609dfbaf33d6889b2b7106d3ca345eacad44200913df5ba02bfd31d2ba9"
 
 [[package]]
 name = "astral-tokio-tar"
-version = "0.5.2"
+version = "0.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1abb2bfba199d9ec4759b797115ba6ae435bdd920ce99783bb53aeff57ba919b"
+checksum = "ec179a06c1769b1e42e1e2cbe74c7dcdb3d6383c838454d063eaac5bbb7ebbe5"
 dependencies = [
  "filetime",
  "futures-core",
@@ -3514,7 +3514,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc2f4eb4bc735547cfed7c0a4922cbd04a4655978c09b54f1f7b228750664c34"
 dependencies = [
  "cfg-if",
- "windows-targets 0.52.6",
+ "windows-targets 0.48.5",
 ]
 
 [[package]]
@@ -4029,9 +4029,9 @@ checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
 
 [[package]]
 name = "openssl"
-version = "0.10.71"
+version = "0.10.74"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e14130c6a98cd258fdcb0fb6d744152343ff729cbfcb28c656a9d12b999fbcd"
+checksum = "24ad14dd45412269e1a30f52ad8f0664f0f4f4a89ee8fe28c3b3527021ebb654"
 dependencies = [
  "bitflags 2.9.0",
  "cfg-if",
@@ -4061,9 +4061,9 @@ checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.106"
+version = "0.9.110"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bb61ea9811cc39e3c2069f40b8b8e2e70d8569b361f879786cc7ed48b777cdd"
+checksum = "0a9f0075ba3c21b09f8e8b2026584b1d18d49388648f2fbbf3c97ea8deced8e2"
 dependencies = [
  "cc",
  "libc",
@@ -8894,7 +8894,7 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]

[niklaskorz]

Note that bumping the OpenSSL crate likely isn't needed in terms of security, we're not using their vendored OpenSSL library but the nixpkgs one for pixi.

[niklaskorz]

Superseded by #457802