Sort Simple API files after grouping

crates/uv-client/src/registry_client.rs

@@ -1505,6 +1505,16 @@ impl SimpleDetailMetadata {
             }
         }
 
+        // Keep file ordering deterministic without sorting the complete Simple API response.
+        for files in version_map.values_mut() {
+            files
+                .wheels
+                .sort_unstable_by(|left, right| left.file.filename.cmp(&right.file.filename));
+            files
+                .source_dists
+                .sort_unstable_by(|left, right| left.file.filename.cmp(&right.file.filename));
+        }
+
         Self {
             versions: version_map
                 .into_iter()

crates/uv-pypi-types/src/simple_json.rs

@@ -21,27 +21,10 @@ pub struct PypiSimpleDetail {
     /// PEP 792 project status information.
     #[serde(default)]
     pub project_status: ProjectStatus,
-    /// The list of [`PypiFile`]s available for download sorted by filename.
-    #[serde(deserialize_with = "sorted_simple_json_files")]
+    /// The list of [`PypiFile`]s available for download.
     pub files: Vec<PypiFile>,
 }
 
-/// Deserializes a sequence of "simple" files from `PyPI` and ensures that they
-/// are sorted in a stable order.
-fn sorted_simple_json_files<'de, D: Deserializer<'de>>(d: D) -> Result<Vec<PypiFile>, D::Error> {
-    let mut files = <Vec<PypiFile>>::deserialize(d)?;
-    // While it has not been positively observed, we sort the files
-    // to ensure we have a defined ordering. Otherwise, if we rely on
-    // the API to provide a stable ordering and doesn't, it can lead
-    // non-deterministic behavior elsewhere. (This is somewhat hand-wavy
-    // and a bit of a band-aide, since arguably, the order of this API
-    // response probably shouldn't have an impact on things downstream from
-    // this. That is, if something depends on ordering, then it should
-    // probably be the thing that does the sorting.)
-    files.sort_unstable_by(|f1, f2| f1.filename.cmp(&f2.filename));
-    Ok(files)
-}
-
 /// A single (remote) file belonging to a package, either a wheel or a source distribution, as
 /// served by the `vnd.pypi.simple.v1` media type.
 ///