[Bug]: serializing a Range Constraint may result in `"any"` which generates a `Version.InvalidRequirementError` in `mix.deps.get`

[dergraf]

Product or component

Hex CLI

Summary

Hi,

In some cases, a dependency version requirement can be serialized as "any" (for example, when an invalid range string is encountered), and that value is then persisted in mix.lock.

If "any" is considered a valid serialized requirement, mix deps.get should be able to interpret it accordingly (for example, by treating it as an unconstrained version requirement). Otherwise, "any" should not be written to mix.lock in the first place.

What happened?

For example, the igniter dependency of oidcc_plug is locked as follows:

  "oidcc_plug": {:hex, :oidcc_plug, "0.5.0", "1192a99b53ff7a4fa64583a4d0f91bd251756d8e267c5b33055139c7e7762855", [:mix], [{:igniter, "any", [hex: :igniter, repo: "hexpm", optional: true]}, {:oidcc, "~> 3.7", [hex: :oidcc, repo: "hexpm", optional: false]}, {:plug, "~> 1.14", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm", "c6c4dbb011e0de165cdda132322aef9792affa8af051a2b8eb7ee4473c643e75"},

However, running mix deps.get fails with:

** (Version.InvalidRequirementError) invalid requirement: "any"
    (hex 2.5.1) lib/hex/solver/requirement.ex:32: Hex.Solver.Requirement.to_constraint!/1
    (hex 2.5.1) lib/hex/remote_converger.ex:765: anonymous fn/1 in Hex.RemoteConverger.verify_deps/4
    (elixir 1.19.5) lib/enum.ex:1688: Enum."-map/2-lists^map/1-1-"/2
    (hex 2.5.1) lib/hex/remote_converger.ex:761: Hex.RemoteConverger.verify_deps/4
    (elixir 1.19.5) lib/enum.ex:961: Enum."-each/2-lists^foreach/1-0-"/2
    (hex 2.5.1) lib/hex/remote_converger.ex:273: Hex.RemoteConverger.solver_success/4
    (mix 1.19.5) lib/mix/dep/converger.ex:137: Mix.Dep.Converger.all/4
    (mix 1.19.5) lib/mix/dep/converger.ex:93: Mix.Dep.Converger.converge/4

What did you expect?

I expected the dependency to be properly resolved.

Steps to reproduce

Add the oidcc_plug dependency with the commit hash found in the lock line above (the issue has been fixed since then), which has a wrong version range for its igniter dependency. The first mix deps.get downloads the dependency and writes "any" in the mix.lock. A following mix deps.get fails with the mentioned InvalidRequirementError.

Environment / context

Erlang/OTP 28 [erts-16.2] [source] [64-bit] [smp:16:16] [ds:16:16:10] [async-threads:1] [jit:ns]

Mix 1.19.5 (compiled with Erlang/OTP 28)

Logs / screenshots

No response

Additional context

Thanks, you're awesome!

[maennchen]

Exact cause was the or instead of the and here: erlef/oidcc_plug@3b4fe54

Source of the any: https://github.com/hexpm/hex/blob/41afbfc3c23bfbeb400909d1afbc07086a7bdd6c/lib/hex/solver/constraints/range.ex#L386-L388