{"id":"5a4fb33752e7c511","repo":"rust-lang/cargo","slug":"source-id-should-have-valid-urls","errorCode":null,"errorMessage":"source ID should have valid URLs","messagePattern":"source ID should have valid URLs","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/resolver/encode.rs","lineNumber":673,"sourceCode":"    }\n    TomlLockfilePackageId {\n        name: id.name().to_string(),\n        version,\n        source,\n    }\n}\n\nfn encodable_source_id(id: SourceId, version: ResolveVersion) -> Option<TomlLockfileSourceId> {\n    if id.is_path() {\n        None\n    } else {\n        Some(\n            if version >= ResolveVersion::V4 {\n                TomlLockfileSourceId::new(id.as_encoded_url().to_string())\n            } else {\n                TomlLockfileSourceId::new(id.as_url().to_string())\n            }\n            .expect(\"source ID should have valid URLs\"),\n        )\n    }\n}\n","sourceCodeStart":655,"sourceCodeEnd":677,"githubUrl":"https://github.com/rust-lang/cargo/blob/0e07a155371a6ce88ae53a2c00df940280c09a67/src/resolver/encode.rs#L655-L677","documentation":"Invariant in lockfile source-id encoding: `encodable_source_id` builds a `TomlLockfileSourceId` from `id.as_encoded_url()` / `id.as_url()` and calls `.expect(\"source ID should have valid URLs\")`. The constructor validates the URL string; cargo assumes every non-path `SourceId` has a URL that serializes cleanly.","triggerScenarios":"Encoding a `Cargo.lock` when a source's URL fails `TomlLockfileSourceId::new`'s validation — e.g. a git/source URL containing characters the lockfile schema rejects, or an internal `SourceId` with an empty/invalid URL.","commonSituations":"A git dependency with an unusual URL (spaces, control chars); a `[source]` replacement or `[patch]` with a malformed URL; a cargo bug constructing a `SourceId` without a URL; very rare for crates.io-style registries.","solutions":["Inspect `[patch]`/`[source]`/git dependency URLs in `Cargo.toml` for unusual characters; URL-encode or fix them.","Reproduce with `cargo generate-lockfile -v` to see which source triggers encoding.","Report a cargo bug with the source URL and lockfile format version."],"exampleFix":"// before\nTomlLockfileSourceId::new(id.as_url().to_string()).expect(\"source ID should have valid URLs\")\n\n// after\nTomlLockfileSourceId::new(id.as_url().to_string())\n    .with_context(|| format!(\"source `{}` has a URL unfit for the lockfile\", id.as_url()))?","handlingStrategy":"validation","validationCode":"// Before generating a lockfile, validate all source URLs serialize cleanly.\nfor sid in sources {\n    let s = sid.as_url().to_string();\n    if url::Url::parse(&s).is_err() {\n        return Err(anyhow!(\"source {} has an invalid URL\", s));\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep `[patch]`/`[source]`/git URLs well-formed and percent-encoded.","Validate registry source URLs after migrations between hosts."],"tags":["cargo","panic","invariant","lockfile","source-id","url","resolver","rust"],"analyzedSha":"0e07a155371a6ce88ae53a2c00df940280c09a67","analyzedAt":"2026-08-06T01:46:58.334Z","schemaVersion":2}