#240 added a cooldown check to PyPIHandler.handleDownload so tarballs for withheld versions return 404. That check calls fetchFilteredVersions, which issues a direct HTTPClient.Do to <upstream>/pypi/<name>/json (internal/handler/pypi.go:119) rather than going through FetchOrCacheMetadata.
Before #240 this only ran once per simple-index request. Now it runs on every file download when cooldown is enabled, so each wheel or sdist fetch adds a synchronous round-trip to the upstream JSON API. The npm side of the same change already routes through FetchOrCacheMetadata and reuses the metadata cache.
fetchFilteredVersions should fetch via FetchOrCacheMetadata (cache key e.g. <name>/json) so repeated downloads for the same package reuse the cached response within the metadata TTL.
#240 added a cooldown check to
PyPIHandler.handleDownloadso tarballs for withheld versions return 404. That check callsfetchFilteredVersions, which issues a directHTTPClient.Doto<upstream>/pypi/<name>/json(internal/handler/pypi.go:119) rather than going throughFetchOrCacheMetadata.Before #240 this only ran once per simple-index request. Now it runs on every file download when cooldown is enabled, so each wheel or sdist fetch adds a synchronous round-trip to the upstream JSON API. The npm side of the same change already routes through
FetchOrCacheMetadataand reuses the metadata cache.fetchFilteredVersionsshould fetch viaFetchOrCacheMetadata(cache key e.g.<name>/json) so repeated downloads for the same package reuse the cached response within the metadata TTL.