Skip to content

Commit

Permalink
docs(poetry): warn about lock file update problems
Browse files Browse the repository at this point in the history
  • Loading branch information
rarkins committed Feb 28, 2024
1 parent 924b9da commit 8c5cbe7
Showing 1 changed file with 10 additions and 0 deletions.
10 changes: 10 additions & 0 deletions lib/modules/manager/poetry/readme.md
Expand Up @@ -8,3 +8,13 @@ The following `depTypes` are supported by the Poetry manager:
- `dev-dependencies`
- `extras`
- `<group-name>` (dynamic, based on the group name, per [dependency groups documentation](https://python-poetry.org/docs/managing-dependencies/#dependency-groups))

<!-- prettier-ignore -->
!!! warning
Updating locked versions of Poetry dependencies is at times unreliable.
We recommended that you pin dependency versions in your `pyproject.toml` instead.

Renovate cannot accurately update locked versions of Poetry dependency ranges due to limitations in Poetry.
For example, if the `pyproject.toml` has a constraint like `coverage = "^7.2"`, and the version ion `poetry.lock` is `7.4.1`, and we know that `7.4.3` is available, then Renovate can only run `poetry update --lock --no-interaction coverage` and _hope_ the result is `7.4.3`.
Poetry does not support updating to a specific/exact version with the `update` command, and the above `update` command may not even update at all sometimes.
For this reason it's much better to pin dependency versions in `pyproject.toml`, such as `coverage = "7.4.1"` because it then gives Renovate more control and the ability to accurate upgrade dependencies in increments like `7.4.1` to `7.4.3`.

0 comments on commit 8c5cbe7

Please sign in to comment.