pixi.lock always outdated with multiple git pypi dependency specifying branches

[linuxrider]

Checks

• I have checked that this issue has not already been reported.

• I have confirmed this bug exists on the latest version of pixi, using pixi --version.

Reproducible example

pixi.toml file that works:

[workspace]
authors = ["author"]
channels = ["conda-forge"]
name = "pixi-git"
platforms = ["linux-64"]
version = "0.1.0"

[tasks]

[dependencies]
python = ">=3.14.2,<3.15"

[pypi-dependencies]
svgdigitizer = {git = "https://github.com/echemdb/svgdigitizer.git", rev = "master"}

Commands I ran and their output:

$ pixi shell -v
 INFO pixi_core::lock_file::outdated: environment 'default' is out of date because it does not exist in the lock-file.
 INFO pixi_core::lock_file::update: resolved conda environment for environment 'default' 'linux-64' in 1s 274ms 166us 656ns
 INFO resolve_pypi{group=default platform=linux-64}: pixi_core::lock_file::resolve::pypi: there are no python packages installed by conda
 INFO pixi_core::lock_file::update: resolved pypi packages for environment 'default' 'linux-64' in 635ms 322us 720ns
 INFO pixi_install_pypi: Installed 63 packages in 23ms
 INFO pixi_install_pypi: finished in 36ms
 INFO pixi_core::lock_file::update: Installed environment 'default' in 244.096852ms
 INFO pixi_cli::shell: Starting shell: Bash(Bash)

$ exit
exit
$ pixi shell -v
 INFO pixi_core::lock_file::update: the lock-file is up-to-date
 INFO pixi_core::environment::conda_metadata: No update needed for the prefix file.
 INFO pixi_install_pypi: Nothing to do - finished in 0ms
 INFO pixi_core::lock_file::update: Installed environment 'default' in 7.834698ms
 INFO pixi_cli::shell: Starting shell: Bash(Bash)

$ pixi shell -v
 INFO pixi_core::lock_file::update: the lock-file is up-to-date
 INFO pixi_core::lock_file::update: Environment 'default' is up-to-date with lock file hash
 INFO pixi_cli::shell: Starting shell: Bash(Bash)

pixi.toml file that reproduces my issue:

[workspace]
authors = ["author"]
channels = ["conda-forge"]
name = "pixi-git"
platforms = ["linux-64"]
version = "0.1.0"

[tasks]

[dependencies]
python = ">=3.14.2,<3.15"

[pypi-dependencies]
svgdigitizer = {git = "https://github.com/echemdb/svgdigitizer.git", rev = "master"}
ec-tools = {git = "https://github.com/echemdb/ec-tools.git"}

$ pixi shell -v
 INFO pixi_core::lock_file::outdated: the pypi dependencies of environment 'default' for platform linux-64 are out of date because the requirement 'ec-tools @ git+https://github.com/echemdb/ec-tools.git' could not be satisfied (required by '<environment>')
 INFO resolve_pypi{group=default platform=linux-64}: pixi_core::lock_file::resolve::pypi: there are no python packages installed by conda
 INFO pixi_core::lock_file::update: resolved pypi packages for environment 'default' 'linux-64' in 2s 895ms 154us 404ns
 INFO pixi_core::environment::conda_metadata: No update needed for the prefix file.
 INFO pixi_install_pypi: Installed 7 packages in 1ms
 INFO pixi_install_pypi: finished in 9ms
 INFO pixi_core::lock_file::update: Installed environment 'default' in 16.76553ms
 INFO pixi_cli::shell: Starting shell: Bash(Bash)

$ exit
exit
$ pixi shell -v
 INFO pixi_core::lock_file::outdated: the dependencies of environment 'default' for platform linux-64 are out of date because 'svgdigitizer' has mismatching git ref: 'master != HEAD'
 INFO pixi_core::lock_file::update: resolved conda environment for environment 'default' 'linux-64' in 1s 290ms 863us 375ns
 INFO resolve_pypi{group=default platform=linux-64}: pixi_core::lock_file::resolve::pypi: there are no python packages installed by conda
 INFO pixi_core::lock_file::update: resolved pypi packages for environment 'default' 'linux-64' in 386ms 873us 447ns
 INFO pixi_core::environment::conda_metadata: No update needed for the prefix file.
 INFO pixi_install_pypi: Nothing to do - finished in 0ms
 INFO pixi_core::lock_file::update: Installed environment 'default' in 7.072771ms
 INFO pixi_cli::shell: Starting shell: Bash(Bash)

pixi info output:

System
------------
       Pixi version: 0.62.1
        TLS backend: rustls
           Platform: linux-64
   Virtual packages: __unix=0=0
                   : __linux=6.17.12=0
                   : __glibc=2.42=0
                   : __archspec=1=zen4
          Cache dir: /home/user/.cache/rattler/cache
       Auth storage: /home/user/.rattler/credentials.json
   Config locations: No config files found

Global
------------
            Bin dir: /home/user/.pixi/bin
    Environment dir: /home/user/.pixi/envs
       Manifest dir: /home/user/.pixi/manifests/pixi-global.toml

Workspace
------------
               Name: pixi-git
            Version: 0.1.0
      Manifest file: /home/user/pixi-git/pixi.toml
       Last updated: 21-12-2025 21:59:32

Environments
------------
        Environment: default
           Features: default
           Channels: conda-forge
   Dependency count: 1
       Dependencies: python
  PyPI Dependencies: svgdigitizer, ec-tools
   Target platforms: linux-64
    Prefix location: /home/user/pixi-git/.pixi/envs/default

Issue description

When specifying a branch for a git pypi dependency while having more than one of these dependencies, pixi always reports the pixi.lock being out-of-date even though nothing changed. This leads to reinstallation of the dependency every time the environment is activated.
It works correctly when no branch is specified.

Expected behavior

Reinstallation should only happen after a change in the repository.

[ruben-arts]

Thanks for the issue, I can reproduce it with v0.62.2 on a osx-arm64 device aswell.

What I found is that for some reason we don't always write the rev to the pixi.lock but we do when we have two git dependencies.

It always goes right when you remove the pixi.lock and rerun pixi lock.
It doesn't work when changing rev to branch.

The lockfile is basically invalid every time you switch from 1 to 2 dependencies or from 2 to 1.

It validates when you have this:

- pypi: git+https://github.com/echemdb/svgdigitizer.git?branch=master#5c3e3b9287af02fa3c5731a874d476d809e656d9

It does not when you have no specifier in the line, which is the result of the lockfile after a resolve:

- pypi: git+https://github.com/echemdb/svgdigitizer.git#5c3e3b9287af02fa3c5731a874d476d809e656d9

@nichmor @tdejager, any ideas?

[nichmor]

strange! I will assign this to me