Repository navigation
poetry lock --no-update changes versions in our poetry.lock #3739
Description
- I am on the latest Poetry version.
- I have searched the issues of this repo and believe that this is not a duplicate.
- If an exception occurs when executing a command, I executed it again in debug mode (
-vvvoption).
- OS version and name: macOS 11.2.2
- Poetry version: 1.1.4
- Link of a Gist with the contents of your pyproject.toml file: https://gist.github.com/beaugunderson/cfb9a818ba42d63a1d14de7dc33a99aa
Issue
Executing poetry lock --no-update (with no changes to pyproject.toml) updates the versions of a dependency in our poetry.lock:
Additionally, when executing the same command with -vvv I get an exception in the debugging code:
Reacted by Pavel Brodsky, Johannes Wienke and Huon Wilson
Activity
beaugunderson commentedon Mar 3, 2021
While the screenshot provided above is a benign change, I ran
poetry lock --no-updatetoday and our version oftwistedwas updated to a version that doesn't work withdaphne, which broke our application.huonw commentedon May 19, 2022
One cause of this appears to be dependencies that use
extras = [...]: they're updated even if--no-updateis specified.I set up two projects, that have the same set of transitive dependencies (
pydantic==1.8,python-dotenv==0.20.0andtyping-extensions==4.2.0):pydantic = {extras = ["dotenv"], version = "^1.8.0"}: https://gist.github.com/huonw/dd12ad4e3329295daee201b66558a8afpydantic = "^1.8.0",python-dotenv = "^0.20.0": https://gist.github.com/huonw/636bddddba56ceb82c8f9983a7d06affBehaviour of running
poetry lock --updatefor each:(Just to be clear, this isn't specific to Pydantic, just it's a convenient package to use for the demo. For instance, we see it with
boto3-stubs = {extras = ["kinesis", "secretsmanager", "sns"], version = "^1.21.13"too, and if we remove theextras = [ ... ]the bad behaviour goes away.}abn commentedon May 19, 2022
@huonw just to understand this, do you mean you
poetry lock --no-updateAnd this causes package A version to be updated instead of simply activating the extra?
radoering commentedon May 19, 2022
May be fixed by #4618. Can you try poetry 1.2.0b1 or master?
huonw commentedon May 19, 2022
Summary: yes, it does seem to be fixed in 1.2.0b1 🎉 Thanks @radoering.
@abn Unfortunately it's a bit more common than that: any package with an extra will be updated if there's a new release on PyPI, without any changes to pyproject.toml at all:
A[extra]boto3-stubsorstrawberry-graphql, or rarely for one like Pydantic)poetry lock --no-updateMy gists were simulating this behaviour, by pretending to be lock files created when pydantic==1.8 was the latest version. This script reproduces the behaviour (outputs in comments for easier copy-pasting):
Click for full poetry.lock diff
Swapping the clone to the other gist (
git clone https://gist.github.com/636bddddba56ceb82c8f9983a7d06aff.git 3739) exhibits the desired behaviour:poetry showstill showspydantic 1.8poetry.lockdoesn't change (git statussaysworking tree clean)Based on this script, 1.2.0b1 does seem to fix the issue.
Click for full output
The changes to poetry.lock are not related to the package updating. It's
content-hashchanging, which I imagine is related to upgrading versions, not this issue:mkniewallner commentedon Jun 18, 2022
Since this appears to be fixed (thanks for testing!), let's close this issue.
1Mark commentedon Jun 30, 2022
i dont think an issue should be closed until it's in a public release since it's hard to find and users may be more inclined to create more issues which in turn take more time to close as dupes.
github-actions commentedon Mar 1, 2024
This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.