Summary

Context: We run a private index that allows/allowed direct references.

A transitive dep (let's call it a > b > metaflow started backtracking and hit an old artifact of b that had a git dependency for metaflow. In this case, what I'd like to see is info on b -- the one that has the dependency, not metaflow (because it's not that project's fault).

Diagnosing:

I managed to run uv -v and exhaustively check metadata urls looking for the string and figure out what was going on.

Solution Finding:

The error message is a little ambiguous on first read -- it seems like it just wants me to add metaflow @ to the beginning of the dep line in b and it would then accept the url dependency, but that comes from an interpretation of "your dependencies". In reality, it doesn't allow direct references at all? If there's an escape hatch, it's not mentioned.

Current error:

error: Package `metaflow` attempted to resolve via URL: git+https://github.com/Netflix/metaflow.git@2.12.29. URL dependencies must be expressed as direct requirements or constraints. Consider adding `metaflow @ git+https://github.com/Netflix/metaflow.git@2.12.29` to your dependencies or constraints file.

A better error would be:

error: Package `foo==2.13.0` contains a url dependency.  URL dependencies MUST be done using direct project requirements or constraints, or with config setting <blah>.

Platform

macOS 15.5 arm64 (M2)

Version

uv 0.8.0 (0b23572 2025-07-17)

Python version

Python 3.10.16 (but that shouldn't matter)