`uv lock` fails when using `dependency-metadata` with a URL dependency

[object-Object]

Summary

When using tool.uv.dependency-metadata to override the dependencies for a package acquired from a URL source, uv sync fails with the following output:

(uv-hash-bug) PS C:\Users\object\uv-hash-bug> uv sync
Resolved 2 packages in 52ms                                                                                                       
error: Since the package `hexdoc-hexal==0.3.0.1.0rc3.dev0 @ direct+https://github.com/vgskye/Hexal/raw/6a8700ec078ec716e368f8e17e32191a0e27bd46/docs/v/latest/remaint/dist/hexdoc_hexal-0.3.0.1.0rc3.dev0-py3-none-any.whl` comes from a direct dependency, a hash was expected but one was not found for wheel

Steps to reproduce

Create a pyproject.toml with the following contents:

[project]
name = "uv-hash-bug"
version = "0.1.0"
requires-python = "~=3.12.0"
dependencies = [
    "hexdoc-hexal",
]

[tool.uv]
dependency-metadata = [
    { name = "hexdoc-hexal", version = "0.3.0.1.0rc3.dev0", requires-dist = [] },
]

[tool.uv.sources]
hexdoc-hexal = { url = "https://github.com/vgskye/Hexal/raw/6a8700ec078ec716e368f8e17e32191a0e27bd46/docs/v/latest/remaint/dist/hexdoc_hexal-0.3.0.1.0rc3.dev0-py3-none-any.whl" }

Then run uv sync.

If the dependency-metadata block is commented out, uv sync works as expected.

Additional context

I encountered this issue here: object-Object/HexBug@8dfd7ea

I need to use dependency-metadata here because hexdoc-hexal depends on hexdoc-hexcasting>=0.11.1.1.0rc7.dev20,<0.11.1.2.dev0, but HexBug depends on hexdoc-hexcasting~=0.11.2.0.

Logs

sync.log

Platform

Windows 11 Education 24H2 x86_64

Version

uv 0.6.10 (f2a2d98 2025-03-25)

Python version

Python 3.12.9

[TomCC7]

Met the same issue here

[konstin]

I need to use dependency-metadata here because hexdoc-hexal depends on hexdoc-hexcasting>=0.11.1.1.0rc7.dev20,<0.11.1.2.dev0, but HexBug depends on hexdoc-hexcasting~=0.11.2.0.

Can you use dependency overrides for this instead? dependency-metadata assumes you're providing correct metadata, while overrides are explicitly of using otherwise incompatible versions.

[object-Object]

Can you use dependency overrides for this instead? dependency-metadata assumes you're providing correct metadata, while overrides are explicitly of using otherwise incompatible versions.

I don't think so - I want to override transitive dependencies for specific packages, not for the entire workspace. If #2686 was implemented, I agree that would be a better solution than using dependency-metadata.

[konstin]

PyPI-only MRE:

[project]
name = "debug"
version = "0.1.0"
requires-python = ">=3.9"
dependencies = [
    "anyio",
]

[tool.uv]
dependency-metadata = [
  { name = "anyio", version = "4.9.0", requires-dist = [] },
]

[tool.uv.sources]
anyio = { url = "https://files.pythonhosted.org/packages/a1/ee/48ca1a7c89ffec8b6a0c5d02b89c305671d5ffd8d3c94acf8b8c408575bb/anyio-4.9.0-py3-none-any.whl" }