Fix duplicate dependency constraint causing 500 errors

- Deduplicate dependencies by package name before inserting
- Some packages (like anyio) list the same dep (trio) multiple times with
  different version constraints for different extras
- The unique constraint on (artifact_id, project, package) rejected these
- Also removed debug logging from dependencies.py
This commit is contained in:
Mondo Diaz
2026-01-30 17:43:49 -06:00
parent befa517485
commit e62e75bade
2 changed files with 9 additions and 18 deletions

View File

@@ -737,8 +737,16 @@ async def pypi_download_file(
# Extract and store dependencies
dependencies = _extract_dependencies(content, filename)
if dependencies:
logger.info(f"PyPI proxy: extracted {len(dependencies)} dependencies from {filename}")
# Deduplicate dependencies by package name (keep first occurrence)
seen_packages = set()
unique_deps = []
for dep_name, dep_version in dependencies:
if dep_name not in seen_packages:
seen_packages.add(dep_name)
unique_deps.append((dep_name, dep_version))
logger.info(f"PyPI proxy: extracted {len(unique_deps)} dependencies from {filename} (deduped from {len(dependencies)})")
for dep_name, dep_version in unique_deps:
# Check if this dependency already exists for this artifact
existing_dep = db.query(ArtifactDependency).filter(
ArtifactDependency.artifact_id == sha256,