Crash on 'mix deps.get' when a dependency has a published version with a '+' (plus sign)

[corben2]

We're using a private hex repo. Some of our erlang packages have a version like: 0.0.0+build.31.ref0c7e071.

Whenever we run 'mix deps.get' with a package as a dependency that has an available version like that, mix crashes. To be clear, the dependency is defined like so:

      {:utils, "~> 1.2.7", repo: "private_hex_repo"},

But there exists on the repo "private_hex_repo" a version of "utils" with a version like 0.0.0+build.31.ref0c7e071.

Here's the stack trace:

** (MatchError) no match of right hand side value: :error
    (hex 2.1.2-dev) lib/hex/solver/package_lister.ex:48: anonymous fn/4 in Hex.Solver.PackageLister.dependencies_as_incompatibilities/4
    (elixir 1.16.3) lib/enum.ex:1700: Enum."-map/2-lists^map/1-1-"/2
    (hex 2.1.2-dev) lib/hex/solver/package_lister.ex:47: Hex.Solver.PackageLister.dependencies_as_incompatibilities/4
    (hex 2.1.2-dev) lib/hex/solver/solver.ex:123: Hex.Solver.Solver.choose_package_version/1
    (hex 2.1.2-dev) lib/hex/solver/solver.ex:25: Hex.Solver.Solver.solve/2
    (hex 2.1.2-dev) lib/hex/solver.ex:64: Hex.Solver.run/5
    (hex 2.1.2-dev) lib/hex/remote_converger.ex:73: Hex.RemoteConverger.run_solver/5
    (mix 1.16.3) lib/mix/dep/converger.ex:133: Mix.Dep.Converger.all/4
    (mix 1.16.3) lib/mix/dep/converger.ex:89: Mix.Dep.Converger.converge/4
    (mix 1.16.3) lib/mix/dep/fetcher.ex:16: Mix.Dep.Fetcher.all/3
    (mix 1.16.3) lib/mix/tasks/deps.get.ex:34: Mix.Tasks.Deps.Get.run/1
    (mix 1.16.3) lib/mix/task.ex:478: anonymous fn/3 in Mix.Task.run_task/5
    (mix 1.16.3) lib/mix/cli.ex:96: Mix.CLI.run_task/2
    c:/Program Files/Elixir/bin/mix:2: (file)

According to the hex spec, I believe version can be any semver, and according to the semver spec I think that's a valid version number.

I've spent some time trying to debug the crash, but haven't been able to. I'm not familiar with the code, and I'm new to elixir.

[supersimple]

Thank you for the report @corben2
I am looking into it now. That is indeed a valid release (according to the semver 2 spec)