Pruned versions make specific uv versions unable to compile

[Flamefire]

I recently tried to recompile uv 0.2.30 (for testing) which has a dependency on reqwest-middleware and reqwest-retry:
https://github.com/astral-sh/uv/blob/0.2.30/Cargo.lock#L3123

However that specific commit does no longer exist/is dangling: astral-sh/reqwest-middleware@21ceec9

It will be removed from GitHub when the reflog expires (about 90 days IIRC)

Can you please do either of

1. avoid removing commits from repositories that are used elsewhere
2. tag such commits (e.g. as reqwests-uv-2.x) to avoid them from expiring
3. avoid using commits not in some branch that will not be deleted, such as main

Otherwise this creates headaches for maintainers of "build scripts", e.g. packages for distros, container images or us at EasyBuild (software build software for HPC)

[charliermarsh]

I don't know what happened there but in general we always tag commits that we use in VCS for this reason. It looks like an oversight by @konstin. We can tag that commit to fix this one up.

[charliermarsh]

Is there a way to get Cargo to fail when building this? Or rather, how did you even detect this?

[charliermarsh]

Thanks @konstin (https://github.com/astral-sh/reqwest-middleware/releases/tag/uv-0.2.30).

[Flamefire]

Is there a way to get Cargo to fail when building this? Or rather, how did you even detect this?

I would expect cargo to fail unless it has the dependency cached. I.e. deleting $HOME/.cargo or setting $CARGOHOME to some empty folder should make it try to download it and fail. Unless it fetches the specific commit directly, which I guess it does. That will work until the reflog is pruned.

In our case we detected that after cloning the repo and trying to checkout the commit (in some generic code that vendors crates)

[charliermarsh]

(I think it worked for me because Konsti had already fixed it, and I didn't realize.)

[konstin]

Upstreamed this to ask for crates.io releases: TrueLayer/reqwest-middleware#198

I've also tagged the version we're using in uv 0.5.0 in the meantime.