@tomasajt:matrix.org already reviewed it as the author of fetchCargoVendor and stated:

I'll look into whether your approach could be improved.

In the meantime you could patch out one of the revisions in the lockfile over to the other revision. It's not guaranteed to be correct, but it might be fine as a hotfix.

Or more importantly, the concerns directly above that:

I really don't see a pretty way of solving this.
Your fix seems to do its job in this case.
However, if we had both a duplicate package and a duplicate selector, even your fix wouldn't work, because we'd be back to the situation that #387337 aimed to solve.