images/Dockerfile installs pixi unpinned:
RUN curl -fsSL https://pixi.sh/install.sh | PIXI_HOME=/usr/local bash
PIXI_VERSION appears nowhere in the repo, so every image build takes whatever pixi latest is that day. Not a security issue (pixi install --locked verifies the lock's PyPI sha256 on both cold and warm cache paths), but a pixi minor bump can change lock handling or resolution behavior with no corresponding change in this repo, making builds non-reproducible and failures hard to bisect.
Fix: pass a pinned version to the installer (PIXI_VERSION=vX.Y.Z) via an ARG, and bump it deliberately.
Raised in review of #241 (review).
images/Dockerfileinstalls pixi unpinned:RUN curl -fsSL https://pixi.sh/install.sh | PIXI_HOME=/usr/local bashPIXI_VERSIONappears nowhere in the repo, so every image build takes whatever pixi latest is that day. Not a security issue (pixi install --lockedverifies the lock's PyPI sha256 on both cold and warm cache paths), but a pixi minor bump can change lock handling or resolution behavior with no corresponding change in this repo, making builds non-reproducible and failures hard to bisect.Fix: pass a pinned version to the installer (
PIXI_VERSION=vX.Y.Z) via an ARG, and bump it deliberately.Raised in review of #241 (review).