When cargo can't find a crate name in a registry, it will also query every permutation of - and _ replacements (up to 1024 times) to see if there is a different match. When this code was written, it was assumed it would just be a simple query to git, but now that the sparse index does a network round trip for each one, it probably isn't a good assumption that doing 1024 is OK.

I think at a minimum it should lower the limit significantly.

Another option is to only do up to 3 queries, the original, all underscore, and all dashes.