Poetry version support #1556

ulgens · 2019-12-04T10:08:42Z

Dependabot supports Poetry but it doesn't use given version in pyproject.toml file. When i use any version newer than 1.0.0a1, update check fails because of changed lock file syntax.

tommilligan · 2019-12-16T09:13:52Z

Would also be interested in this. Just upgraded to the newly released poetry v1 and getting the error:

updater | ERROR <job_17789943> Error processing tld (Dependabot::SharedHelpers::HelperSubprocessFailed)
updater | ERROR <job_17789943>                                   
updater | <job_17789943> [NonExistentKey]   
updater | <job_17789943> 'Key "hashes" does not exist.'  
updater | <job_17789943>                                   
updater | <job_17789943> update [--no-dev] [--dry-run] [--lock] [--] [<packages>]...
updater | <job_17789943>

sobolevn · 2019-12-18T08:30:30Z

I am all in for this change!

Repo that has this problem: https://github.com/wemake-services/wemake-python-styleguide/blob/master/pyproject.toml

Poetry version is specified in the build file:

[build-system]
requires = ["poetry>=1.0"]
build-backend = "poetry.masonry.api"

But, it does not work. What website says:

Logs:

updater | ERROR <job_18040832> Error processing astboom (Dependabot::SharedHelpers::HelperSubprocessFailed)
updater | ERROR <job_18040832>                                   
updater | <job_18040832> [NonExistentKey]   
updater | <job_18040832> 'Key "hashes" does not exist.'  
updater | <job_18040832>                                   
updater | <job_18040832> update [--no-dev] [--dry-run] [--lock] [--] [<packages>]...
updater | <job_18040832> 
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-python-0.113.28/lib/dependabot/python/update_checker/poetry_version_resolver.rb:319:in `run_poetry_command'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-python-0.113.28/lib/dependabot/python/update_checker/poetry_version_resolver.rb:85:in `block (2 levels) in fetch_latest_resolvable_version_string'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/shared_helpers.rb:143:in `with_git_configured'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-python-0.113.28/lib/dependabot/python/update_checker/poetry_version_resolver.rb:73:in `block in fetch_latest_resolvable_version_string'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/shared_helpers.rb:37:in `block (2 levels) in in_a_temporary_directory'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/shared_helpers.rb:37:in `chdir'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/shared_helpers.rb:37:in `block in in_a_temporary_directory'
updater | ERROR <job_18040832> /usr/lib/ruby/2.6.0/tmpdir.rb:93:in `mktmpdir'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/shared_helpers.rb:34:in `in_a_temporary_directory'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-python-0.113.28/lib/dependabot/python/update_checker/poetry_version_resolver.rb:72:in `fetch_latest_resolvable_version_string'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-python-0.113.28/lib/dependabot/python/update_checker/poetry_version_resolver.rb:42:in `latest_resolvable_version'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-python-0.113.28/lib/dependabot/python/update_checker.rb:43:in `latest_resolvable_version'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/update_checkers/base.rb:70:in `preferred_resolvable_version'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/update_checkers/base.rb:233:in `preferred_version_resolvable_with_unlock?'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/update_checkers/base.rb:225:in `numeric_version_can_update?'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/update_checkers/base.rb:175:in `version_can_update?'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/update_checkers/base.rb:38:in `can_update?'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/lib/dependabot/updater.rb:208:in `requirements_to_unlock'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/lib/dependabot/updater.rb:159:in `check_and_create_pull_request'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/lib/dependabot/updater.rb:62:in `check_and_create_pr_with_error_handling'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/lib/dependabot/updater.rb:48:in `block in run'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/lib/dependabot/updater.rb:48:in `each'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/lib/dependabot/updater.rb:48:in `run'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/lib/dependabot/update_files_job.rb:16:in `perform_job'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/lib/dependabot/base_job.rb:29:in `run'
updater | ERROR <job_18040832> bin/update_files.rb:21:in `<main>'

In case making a support for several versions is a hard thing, then I suggest to drop poetry@0.x support in favour of poetry@1.x support. Because update process is easy for developers.

sobolevn · 2019-12-20T05:53:47Z

At this point I have upgraded almost all my packages to poetry@1.0 and dependabot almost stoped working to me 😞

m-aciek · 2020-01-08T09:31:57Z

Related pull requests: #1571, #1623, #1624. Related issue on feedback repo: https://github.com/dependabot/feedback/issues/798.

gabor-boros · 2020-01-16T14:56:49Z

Any update on this?

cjolowicz · 2020-02-09T09:45:29Z

The automated pull request for Poetry 1.0.3 is here: #1667

Note: this is supposed to be working automatically with dependabot, but there's an outstanding issue yet to be resolved at dependabot/dependabot-core#1556 Hopefully this gets resolved soon.

ulgens · 2020-03-14T04:10:12Z

#1710

~~Does anyone have any idea why this test fails?~~

Tests are failing because dependabot can't parse new lock file format. Any Ruby developers to help with it? 🤕

sobolevn · 2020-03-14T08:39:59Z

dependendabot is not working for me for almost 4 month now. Sadly, but there's nothing I can do about it.

tommilligan · 2020-03-15T19:01:47Z

@ulgens I've submitted PR #1739, which fixes the failing tests you mentioned. The fix is only in the tests themselves, so hopefully should be a quick review.

tetienne · 2020-03-26T09:43:06Z

Issue is now solved.

sobolevn · 2020-03-26T11:40:32Z

Not fully. There are several issues:

I got a lot of spam like this: https://github.com/wemake-services/wemake-python-styleguide/issues?q=is%3Aissue+author%3Aapp%2Fdependabot-preview+is%3Aclosed
Every dependency update has merge conflicts. Because of the [metadata].content-hash field: https://github.com/wemake-services/wemake-python-styleguide/pull/1287/files#diff-41fe8bebc1a2a52eb5321b759e40b3a8R1627 Now all merge must be done like: merge first -> rebase second -> merge second. I guess it is a problem with poetry. Here's the upstream issue: Make the lock file more merge-friendly python-poetry/poetry#496

There's a workaround for the second problem: https://pypi.org/project/poetry-merge-lock/

sobolevn · 2020-03-26T12:07:45Z

Also dependabot cannot update my deps, here's what it says: wemake-services/wemake-python-styleguide#1286 (comment)

Note: this is supposed to be working automatically with dependabot, but there's an outstanding issue yet to be resolved at dependabot/dependabot-core#1556 Hopefully this gets resolved soon.

donbowman · 2020-07-11T16:11:49Z

Not fully. There are several issues:

I got a lot of spam like this: https://github.com/wemake-services/wemake-python-styleguide/issues?q=is%3Aissue+author%3Aapp%2Fdependabot-preview+is%3Aclosed

Every dependency update has merge conflicts. Because of the [metadata].content-hash field: https://github.com/wemake-services/wemake-python-styleguide/pull/1287/files#diff-41fe8bebc1a2a52eb5321b759e40b3a8R1627 Now all merge must be done like: merge first -> rebase second -> merge second. I guess it is a problem with poetry. Here's the upstream issue: python-poetry/poetry#496

There's a workaround for the second problem: https://pypi.org/project/poetry-merge-lock/

python-poetry/poetry#2654 is my PR to poetry to try and resolve this issue upstream. It seeks to make content-hash omitted, so no merge conflict.

chbndrhnns · 2021-05-17T07:47:15Z

https://pypi.org/project/poetry-merge-lock/ seems archived now.
Are other known workarounds to this issue?

cjolowicz · 2021-05-22T19:34:22Z

@chbndrhnns These days I use a small shell script with these commands:

git restore --worktree --staged poetry.lock
poetry lock --no-update
git add poetry.lock

See this comment for more details.

Some annoyances & errors, doesn't seem like poetry support is fully developed. dependabot/dependabot-core#1556

jeffwidman · 2022-11-24T18:35:05Z

Thanks for the feedback, it's Thanksgiving holiday here so I don't have time to look at this in detail as about to head to family gathering, but re-opening so we don't lose track of this.

edgarrmondragon · 2022-12-23T22:25:15Z

Bump for this. Poetry 1.3 has a new lock poetry.lock format, so dependabot is rewriting the file with the old format 😕

phillipuniverse · 2022-12-24T02:04:45Z

@edgarrmondragon the Poetry 1.3 update in dependabot is at:

Update poetry requirement from <1.3.0,>=1.1.15 to >=1.1.15,<1.4.0 in /python/helpers #6302

deivid-rodriguez · 2023-01-11T12:47:28Z

I agree we should do something about this, but it's tricky.

As per python-poetry/poetry#3316, the poetry-core version information in the [build-system] table in pyproject.toml is currently ignored by Poetry, so that does not seem the way to go.

There's a lock-version field in the [metadata] table, which tells us the format of the lockfile that we should generate, but that's not enough to figure out which version of poetry we should use to generate that format. So the only idea I can think of is the we keep this mapping ourselves, which I guess would work but feels not great.

jeffwidman · 2023-01-11T19:22:27Z

I'm pretty hesitant to get into the business of storing state ourselves on this. Much prefer we wait for poetry itself to add support for specifying the minimum working version... Looking at the discussion in python-poetry/poetry#3316, it seems the poetry maintainers are open to the idea, just no one has worked on it yet.

deivid-rodriguez · 2023-01-11T19:35:25Z

I agree with you, I was just sharing the only workaround on our side that I could think of at the moment that does not involve poetry itself recording the version/requirement somehow.

xmnlab · 2023-02-07T16:33:37Z

hi everyone! is this issue still a problem or was it already fixed?

deivid-rodriguez · 2023-02-07T16:36:49Z

Still a problem I think. There's been no movement here, so I don't expect this to have been fixed.

xmnlab · 2023-02-07T16:43:36Z

@deivid-rodriguez, thanks for the quick response!

ulgens · 2023-02-09T11:19:06Z

Yep, still a problem.

d3QUone · 2023-02-24T16:05:41Z

Hi team! Any updates here?

deivid-rodriguez · 2023-02-24T16:46:06Z

No news @d3QUone. I will post an update when there's something to share.

tianhuil · 2023-04-01T04:11:28Z

Any updates here?

larsakerson · 2023-05-30T14:28:45Z

Any updates here? Dependabot's commits aren't honoring the python patch version specified in pyproject.toml. They consistently replace it in poetry.lock with a tilde version specification, causing build failures.

denys-marichev-sumup · 2023-06-05T09:53:03Z

Any updates here? Dependabot's commits aren't honoring the python patch version specified in pyproject.toml. They consistently replace it in poetry.lock with a tilde version specification, causing build failures.

Same problem 🥲

In my pyproject.toml file:

[tool.poetry.dependencies]
python = "3.9.16"

And Dependabot is always trying to replace the line python-versions = "3.9.16" with python-versions = "~3.9" in poetry.lock file 😟

jeffwidman · 2023-08-19T07:35:51Z

☝️ sounds like a specific bug that isn't related to this general thread of "support multiple versions of poetry/poetry.lock"...

Can you spin that off as a specific issue? I can't guarantee that we'll get to it (in fact a PR would be most welcome!) but it should be a lot more tractable to say "retain specific python pin from pyproject.toml to poetry.lock than it is to say "run with my desired poetry version"... because we should be retaining specific python pins no matter whether we stick with a single poetry version or mutliple.

rebelagentm added L: python:poetry Python packages via poetry T: feature-request Requests for new features labels Dec 4, 2019

cjolowicz mentioned this issue Dec 23, 2019

NonExistentKey: 'Key "hashes" does not exist #1596

Closed

callahad mentioned this issue Jan 31, 2020

Configure Dependabot or Renovate to monitor Python dependencies mdn/kuma#6175

Closed

amureki mentioned this issue Jan 31, 2020

Support multiple poetry versions #1621

Closed

rnegron mentioned this issue Feb 2, 2020

Add Dependabot support django-athm/django-athm#1

Closed

tommilligan mentioned this issue Mar 15, 2020

python: upgrade to poetry ^1.0.0 #1739

Merged

sobolevn mentioned this issue Mar 27, 2020

Bump wemake-python-styleguide from 0.13.4 to 0.14.0 wemake-services/django-test-migrations#52

Closed

infin8x added the F: language-support Issues specific to a particular language or ecosystem; may be paired with an L: label. label Jul 20, 2020

infin8x mentioned this issue Jul 20, 2020

Bump Poetry to 1.0.0 #2069

Closed

jtpavlock added a commit to MoeMusic/Moe that referenced this issue Jul 12, 2021

ci: remove dependabot

4436ab5

Some annoyances & errors, doesn't seem like poetry support is fully developed. dependabot/dependabot-core#1556

jtpavlock mentioned this issue Jul 12, 2021

ci: remove dependabot MoeMusic/Moe#100

Merged

jtpavlock added a commit to MoeMusic/Moe that referenced this issue Jul 12, 2021

ci: remove dependabot

b7438ee

Some annoyances & errors, doesn't seem like poetry support is fully developed. dependabot/dependabot-core#1556

jeffwidman reopened this Nov 24, 2022

NathanVaughn added a commit to The-AVR/AVR-VMC-Thermal-Module that referenced this issue Dec 28, 2022

Temporary fix for dependabot/dependabot-core#1556

d69c4af

DMRobertson mentioned this issue Jan 16, 2023

RFC: how to deal with poetry 1.3's new lockfile format matrix-org/synapse#14857

Closed

rcaneill mentioned this issue Feb 11, 2023

Bump ipython from 8.7.0 to 8.10.0 rcaneill/xnemogcm#39

Closed

justinpolygon mentioned this issue Mar 1, 2023

Fix for failing dependabot PRs polygon-io/client-python#395

Merged

deivid-rodriguez mentioned this issue Mar 1, 2023

Update poetry requirement from <1.4.0,>=1.1.15 to >=1.1.15,<1.5.0 in /python/helpers #6758

Closed

bhearsum mentioned this issue Mar 23, 2023

switch dependency management and package installation to poetry mozilla-releng/shipit#1304

Merged

zanieb mentioned this issue Mar 24, 2023

Add minimal dependabot configuration zanieb/poetry-relax#14

Merged

abdulapopoola added the versioning label Mar 31, 2023

phillipuniverse mentioned this issue Jun 21, 2023

Can specify poetry version to use #7435

Closed

1 task

phillipuniverse mentioned this issue Aug 21, 2023

Add support for Poetry 1.5 lockfiles #7834

Merged

deivid-rodriguez mentioned this issue Aug 25, 2023

Poetry >=1.5.0 removes category from poetry.lock #7389

Closed

1 task

jonjanego added the Keep Exempt this from being marked by stalebot label May 2, 2024

LimpFoot2 mentioned this issue May 7, 2024

[Snyk] Upgrade web3 from 0.18.4 to 0.20.7 LimpFoot2/dependabot-core#274

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Poetry version support #1556

Poetry version support #1556

ulgens commented Dec 4, 2019

tommilligan commented Dec 16, 2019

sobolevn commented Dec 18, 2019 •

edited

sobolevn commented Dec 20, 2019

m-aciek commented Jan 8, 2020 •

edited

gabor-boros commented Jan 16, 2020

cjolowicz commented Feb 9, 2020

ulgens commented Mar 14, 2020 •

edited

sobolevn commented Mar 14, 2020

tommilligan commented Mar 15, 2020

tetienne commented Mar 26, 2020

sobolevn commented Mar 26, 2020

sobolevn commented Mar 26, 2020

donbowman commented Jul 11, 2020

chbndrhnns commented May 17, 2021

cjolowicz commented May 22, 2021

jeffwidman commented Nov 24, 2022 •

edited

edgarrmondragon commented Dec 23, 2022 •

edited

phillipuniverse commented Dec 24, 2022 •

edited by jeffwidman

deivid-rodriguez commented Jan 11, 2023 •

edited

jeffwidman commented Jan 11, 2023

deivid-rodriguez commented Jan 11, 2023

xmnlab commented Feb 7, 2023

deivid-rodriguez commented Feb 7, 2023

xmnlab commented Feb 7, 2023

ulgens commented Feb 9, 2023

d3QUone commented Feb 24, 2023

deivid-rodriguez commented Feb 24, 2023

tianhuil commented Apr 1, 2023

larsakerson commented May 30, 2023

denys-marichev-sumup commented Jun 5, 2023 •

edited

jeffwidman commented Aug 19, 2023

Poetry version support #1556

Poetry version support #1556

Comments

ulgens commented Dec 4, 2019

tommilligan commented Dec 16, 2019

sobolevn commented Dec 18, 2019 • edited

sobolevn commented Dec 20, 2019

m-aciek commented Jan 8, 2020 • edited

gabor-boros commented Jan 16, 2020

cjolowicz commented Feb 9, 2020

ulgens commented Mar 14, 2020 • edited

sobolevn commented Mar 14, 2020

tommilligan commented Mar 15, 2020

tetienne commented Mar 26, 2020

sobolevn commented Mar 26, 2020

sobolevn commented Mar 26, 2020

donbowman commented Jul 11, 2020

chbndrhnns commented May 17, 2021

cjolowicz commented May 22, 2021

jeffwidman commented Nov 24, 2022 • edited

edgarrmondragon commented Dec 23, 2022 • edited

phillipuniverse commented Dec 24, 2022 • edited by jeffwidman

deivid-rodriguez commented Jan 11, 2023 • edited

jeffwidman commented Jan 11, 2023

deivid-rodriguez commented Jan 11, 2023

xmnlab commented Feb 7, 2023

deivid-rodriguez commented Feb 7, 2023

xmnlab commented Feb 7, 2023

ulgens commented Feb 9, 2023

d3QUone commented Feb 24, 2023

deivid-rodriguez commented Feb 24, 2023

tianhuil commented Apr 1, 2023

larsakerson commented May 30, 2023

denys-marichev-sumup commented Jun 5, 2023 • edited

jeffwidman commented Aug 19, 2023

sobolevn commented Dec 18, 2019 •

edited

m-aciek commented Jan 8, 2020 •

edited

ulgens commented Mar 14, 2020 •

edited

jeffwidman commented Nov 24, 2022 •

edited

edgarrmondragon commented Dec 23, 2022 •

edited

phillipuniverse commented Dec 24, 2022 •

edited by jeffwidman

deivid-rodriguez commented Jan 11, 2023 •

edited

denys-marichev-sumup commented Jun 5, 2023 •

edited