verified_releases covers every resolved hex package

Error message

verified_releases covers every resolved hex package

What it means

After version resolution, the dependency manager looks each resolved package up in verified_releases (release metadata already fetched). The code asserts every resolved Hex package has an entry there; a missing entry means the pre-fetch/verification step skipped a package that the resolver later selected.

Solutions

Clear the build directory and re-run `gleam deps download` so metadata is refetched
Wait and retry if you just published the package — Hex CDN/cache may lag
Remove manifest.toml and re-resolve to force a fresh, consistent resolution
Report to the Gleam repo with your manifest if it reproduces — it indicates a resolver bug

Defensive patterns

Strategy: retry

Try / catch

// Wrap the dependency command in a retry after clearing caches
rm -rf build && gleam deps download || (sleep 5 && rm -rf build manifest.toml && gleam deps download)

Prevention

Clear the build directory whenever dependency resolution behaves inconsistently
Don't resolve dependencies immediately after publishing a package — allow Hex cache to settle
Pin dependency versions in manifest.toml to avoid re-resolution races

When it happens

Trigger: Running `gleam deps download`/`update` where the resolver picks a package whose available-versions data was never fetched or was evicted — e.g. a newly published package version racing with cached metadata, or provided-package filtering removing the entry.

Common situations: Race between publishing a package on Hex and resolving it locally; corrupted or partially-written dependency cache; compiler bugs in how verified releases are seeded from provided packages.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

AI-assisted analysis of gleam-lang/gleam@15b07c7830 (2026-09-14). Data as JSON: /api/errors/a33d43b6f1f0ee3f. Report an issue: GitHub.

Appendix: source

Thrown at compiler-cli/src/dependencies/dependency_manager.rs:371

        let verified_releases =
            verified_releases(&self.package_fetcher, &resolved, &provided_packages)?;

        // Convert the hex packages and local packages into manifest packages
        let credentials = crate::hex::read_env_readonly_api_key();
        let manifest_packages =
            self.runtime
                .block_on(future::try_join_all(resolved.into_iter().map(
                    |(name, version)| async {
                        // Local and git packages are provided directly; hex packages
                        // are looked up and pinned to their signed release metadata.
                        match provided_packages.get(name.as_str()) {
                            Some(package) => Ok(package.to_manifest_package(name.as_str())),
                            None => {
                                let verified = verified_releases
                                    .get(&name)
                                    .cloned()
                                    .expect("verified_releases covers every resolved hex package");
                                lookup_hex_package(name, version, verified, credentials.as_ref())
                                    .await
                            }
                        }
                    },
                )))?;

        let manifest = Manifest {
            packages: manifest_packages,
            requirements: config.all_direct_dependencies()?,
        };

        Ok(manifest)
    }
}

View on GitHub (pinned to 15b07c7830)