{"record":{"id":"a33d43b6f1f0ee3f","repo":"gleam-lang/gleam","slug":"verified-releases-covers-every-resolved-hex-package","errorCode":null,"errorMessage":"verified_releases covers every resolved hex package","messagePattern":"verified_releases covers every resolved hex package","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"compiler-cli/src/dependencies/dependency_manager.rs","lineNumber":371,"sourceCode":"\n        let verified_releases =\n            verified_releases(&self.package_fetcher, &resolved, &provided_packages)?;\n\n        // Convert the hex packages and local packages into manifest packages\n        let credentials = crate::hex::read_env_readonly_api_key();\n        let manifest_packages =\n            self.runtime\n                .block_on(future::try_join_all(resolved.into_iter().map(\n                    |(name, version)| async {\n                        // Local and git packages are provided directly; hex packages\n                        // are looked up and pinned to their signed release metadata.\n                        match provided_packages.get(name.as_str()) {\n                            Some(package) => Ok(package.to_manifest_package(name.as_str())),\n                            None => {\n                                let verified = verified_releases\n                                    .get(&name)\n                                    .cloned()\n                                    .expect(\"verified_releases covers every resolved hex package\");\n                                lookup_hex_package(name, version, verified, credentials.as_ref())\n                                    .await\n                            }\n                        }\n                    },\n                )))?;\n\n        let manifest = Manifest {\n            packages: manifest_packages,\n            requirements: config.all_direct_dependencies()?,\n        };\n\n        Ok(manifest)\n    }\n}\n","sourceCodeStart":353,"sourceCodeEnd":387,"githubUrl":"https://github.com/gleam-lang/gleam/blob/15b07c783065c92bb016b1b74ed0995a5259850f/compiler-cli/src/dependencies/dependency_manager.rs#L353-L387","documentation":"After version resolution, the dependency manager looks each resolved package up in verified_releases (release metadata already fetched). The code asserts every resolved Hex package has an entry there; a missing entry means the pre-fetch/verification step skipped a package that the resolver later selected.","triggerScenarios":"Running `gleam deps download`/`update` where the resolver picks a package whose available-versions data was never fetched or was evicted — e.g. a newly published package version racing with cached metadata, or provided-package filtering removing the entry.","commonSituations":"Race between publishing a package on Hex and resolving it locally; corrupted or partially-written dependency cache; compiler bugs in how verified releases are seeded from provided packages.","solutions":["Clear the build directory and re-run `gleam deps download` so metadata is refetched","Wait and retry if you just published the package — Hex CDN/cache may lag","Remove manifest.toml and re-resolve to force a fresh, consistent resolution","Report to the Gleam repo with your manifest if it reproduces — it indicates a resolver bug"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Wrap the dependency command in a retry after clearing caches\nrm -rf build && gleam deps download || (sleep 5 && rm -rf build manifest.toml && gleam deps download)","preventionTips":["Clear the build directory whenever dependency resolution behaves inconsistently","Don't resolve dependencies immediately after publishing a package — allow Hex cache to settle","Pin dependency versions in manifest.toml to avoid re-resolution races"],"tags":["dependency-resolution","hex","cache","panic"],"backgroundTag":"internal-invariant-violation","analyzedSha":"15b07c783065c92bb016b1b74ed0995a5259850f","analyzedAt":"2026-09-14T11:14:59.388Z","contentChangedAt":"2026-09-14T11:14:59.388Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}