uv download fails with {:header_too_long, {:max, 10240}} (GitHub release redirect headers) #53

Since around 2026-10-22, Pythonx.Utils.fetch_body!/1 fails whenever uv is not already in the cache, so a cold compile of pythonx fails:

** (RuntimeError) failed to fetch https://github.com/astral-sh/uv/releases/download/0.8.5/uv-x86_64-unknown-linux-gnu.tar.gz, error: {:error, {:header_too_long, {:max, 10240}}}
    lib/pythonx/utils.ex:40: Pythonx.Utils.fetch_body!/1
    lib/pythonx/uv.ex:211: Pythonx.Uv.download!/1
    lib/pythonx/uv.ex:180: Pythonx.Uv.run!/2
    lib/pythonx/uv.ex:41: Pythonx.Uv.fetch/3
    lib/pythonx/application.ex:34: (module)
could not compile dependency :pythonx, "mix compile" failed.

This hits fresh CI caches, Docker builds and new machines. Seen on pythonx 0.4.10, Elixir 1.20.4, OTP 29.

Cause

GitHub's 302 for release downloads now carries a large content-security-policy header (~9.2 KB), so the first-hop response headers exceed :httpc's default max_header_size of 10,240 bytes. fetch_body!/1 passes only [body_format: :binary] as request options, so the limit can't be raised from outside. The same thing broke other libraries that download from GitHub Releases with :httpc: philss/rustler_precompiled#114 (fix: philss/rustler_precompiled#113, same one-line max_header_size change) and phoenixframework/tailwind (fixed in 0.5.2).

Reproduce

Outside pythonx, with the same call shape:

{:ok, _} = Application.ensure_all_started([:inets, :ssl, :public_key])
url = ~c"https://github.com/astral-sh/uv/releases/download/0.8.5/uv-x86_64-unknown-linux-gnu.tar.gz"
http = [ssl: [cacerts: :public_key.cacerts_get(), verify: :verify_peer, customize_hostname_check: [match_fun: :public_key.pkix_verify_hostname_match_fun(:https)]]]

:httpc.request(:get, {url, []}, http, body_format: :binary)
#=> {:error, {:header_too_long, {:max, 10240}}}

:httpc.request(:get, {url, []}, http, body_format: :binary, max_header_size: 32_768)
#=> {:ok, {{_, 200, _}, _, body}}   # 18,942,501 bytes

(Run 2026-10-24 on OTP 29 / Elixir 1.20.4. curl -sIL on the same URL shows the final response is 200 with a normal size; only the first hop is over the limit.)

Fix

Add max_header_size to the request options in lib/pythonx/utils.ex:

options = [body_format: :binary, max_header_size: 32_768]

phoenixframework/tailwind did the same (32_768, PR #142), and philss/rustler_precompiled#113 is the same change (65_536).

Workaround

pythonx skips the download when uv is already at <cache>/<pythonx version>/uv/<uv version>/bin/uv (Pythonx.Uv.run!/2), so pre-fetching it with curl into that path before compiling works.