Poetry version support #1556

ulgens · 2019-12-04T10:08:42Z

Dependabot supports Poetry but it doesn't use given version in pyproject.toml file. When i use any version newer than 1.0.0a1, update check fails because of changed lock file syntax.

tommilligan · 2019-12-16T09:13:52Z

Would also be interested in this. Just upgraded to the newly released poetry v1 and getting the error:

updater | ERROR <job_17789943> Error processing tld (Dependabot::SharedHelpers::HelperSubprocessFailed)
updater | ERROR <job_17789943>                                   
updater | <job_17789943> [NonExistentKey]   
updater | <job_17789943> 'Key "hashes" does not exist.'  
updater | <job_17789943>                                   
updater | <job_17789943> update [--no-dev] [--dry-run] [--lock] [--] [<packages>]...
updater | <job_17789943>

sobolevn · 2019-12-18T08:30:30Z

I am all in for this change!

Repo that has this problem: https://github.com/wemake-services/wemake-python-styleguide/blob/master/pyproject.toml

Poetry version is specified in the build file:

[build-system]
requires = ["poetry>=1.0"]
build-backend = "poetry.masonry.api"

But, it does not work. What website says:

Logs:

updater | ERROR <job_18040832> Error processing astboom (Dependabot::SharedHelpers::HelperSubprocessFailed)
updater | ERROR <job_18040832>                                   
updater | <job_18040832> [NonExistentKey]   
updater | <job_18040832> 'Key "hashes" does not exist.'  
updater | <job_18040832>                                   
updater | <job_18040832> update [--no-dev] [--dry-run] [--lock] [--] [<packages>]...
updater | <job_18040832> 
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-python-0.113.28/lib/dependabot/python/update_checker/poetry_version_resolver.rb:319:in `run_poetry_command'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-python-0.113.28/lib/dependabot/python/update_checker/poetry_version_resolver.rb:85:in `block (2 levels) in fetch_latest_resolvable_version_string'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/shared_helpers.rb:143:in `with_git_configured'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-python-0.113.28/lib/dependabot/python/update_checker/poetry_version_resolver.rb:73:in `block in fetch_latest_resolvable_version_string'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/shared_helpers.rb:37:in `block (2 levels) in in_a_temporary_directory'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/shared_helpers.rb:37:in `chdir'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/shared_helpers.rb:37:in `block in in_a_temporary_directory'
updater | ERROR <job_18040832> /usr/lib/ruby/2.6.0/tmpdir.rb:93:in `mktmpdir'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/shared_helpers.rb:34:in `in_a_temporary_directory'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-python-0.113.28/lib/dependabot/python/update_checker/poetry_version_resolver.rb:72:in `fetch_latest_resolvable_version_string'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-python-0.113.28/lib/dependabot/python/update_checker/poetry_version_resolver.rb:42:in `latest_resolvable_version'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-python-0.113.28/lib/dependabot/python/update_checker.rb:43:in `latest_resolvable_version'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/update_checkers/base.rb:70:in `preferred_resolvable_version'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/update_checkers/base.rb:233:in `preferred_version_resolvable_with_unlock?'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/update_checkers/base.rb:225:in `numeric_version_can_update?'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/update_checkers/base.rb:175:in `version_can_update?'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/update_checkers/base.rb:38:in `can_update?'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/lib/dependabot/updater.rb:208:in `requirements_to_unlock'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/lib/dependabot/updater.rb:159:in `check_and_create_pull_request'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/lib/dependabot/updater.rb:62:in `check_and_create_pr_with_error_handling'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/lib/dependabot/updater.rb:48:in `block in run'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/lib/dependabot/updater.rb:48:in `each'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/lib/dependabot/updater.rb:48:in `run'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/lib/dependabot/update_files_job.rb:16:in `perform_job'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/lib/dependabot/base_job.rb:29:in `run'
updater | ERROR <job_18040832> bin/update_files.rb:21:in `<main>'

In case making a support for several versions is a hard thing, then I suggest to drop [email protected] support in favour of [email protected] support. Because update process is easy for developers.

sobolevn · 2019-12-20T05:53:47Z

At this point I have upgraded almost all my packages to [email protected] and dependabot almost stoped working to me 😞

m-aciek · 2020-01-08T09:31:57Z

Related pull requests: #1571, #1623, #1624. Related issue on feedback repo: https://github.com/dependabot/feedback/issues/798.

gabor-boros · 2020-01-16T14:56:49Z

Any update on this?

cjolowicz · 2020-02-09T09:45:29Z

The automated pull request for Poetry 1.0.3 is here: #1667

Note: this is supposed to be working automatically with dependabot, but there's an outstanding issue yet to be resolved at dependabot/dependabot-core#1556 Hopefully this gets resolved soon.

ulgens · 2020-03-14T04:10:12Z

#1710

~~Does anyone have any idea why this test fails?~~

Tests are failing because dependabot can't parse new lock file format. Any Ruby developers to help with it? 🤕

sobolevn · 2020-03-14T08:39:59Z

dependendabot is not working for me for almost 4 month now. Sadly, but there's nothing I can do about it.

tommilligan · 2020-03-15T19:01:47Z

@ulgens I've submitted PR #1739, which fixes the failing tests you mentioned. The fix is only in the tests themselves, so hopefully should be a quick review.

tetienne · 2020-03-26T09:43:06Z

Issue is now solved.

sobolevn · 2020-03-26T11:40:32Z

Not fully. There are several issues:

I got a lot of spam like this: https://github.com/wemake-services/wemake-python-styleguide/issues?q=is%3Aissue+author%3Aapp%2Fdependabot-preview+is%3Aclosed
Every dependency update has merge conflicts. Because of the [metadata].content-hash field: https://github.com/wemake-services/wemake-python-styleguide/pull/1287/files#diff-41fe8bebc1a2a52eb5321b759e40b3a8R1627 Now all merge must be done like: merge first -> rebase second -> merge second. I guess it is a problem with poetry. Here's the upstream issue: Make the lock file more merge-friendly python-poetry/poetry#496

There's a workaround for the second problem: https://pypi.org/project/poetry-merge-lock/

sobolevn · 2020-03-26T12:07:45Z

Also dependabot cannot update my deps, here's what it says: wemake-services/wemake-python-styleguide#1286 (comment)

Note: this is supposed to be working automatically with dependabot, but there's an outstanding issue yet to be resolved at dependabot/dependabot-core#1556 Hopefully this gets resolved soon.

donbowman · 2020-07-11T16:11:49Z

Not fully. There are several issues:

I got a lot of spam like this: https://github.com/wemake-services/wemake-python-styleguide/issues?q=is%3Aissue+author%3Aapp%2Fdependabot-preview+is%3Aclosed

Every dependency update has merge conflicts. Because of the [metadata].content-hash field: https://github.com/wemake-services/wemake-python-styleguide/pull/1287/files#diff-41fe8bebc1a2a52eb5321b759e40b3a8R1627 Now all merge must be done like: merge first -> rebase second -> merge second. I guess it is a problem with poetry. Here's the upstream issue: python-poetry/poetry#496

There's a workaround for the second problem: https://pypi.org/project/poetry-merge-lock/

python-poetry/poetry#2654 is my PR to poetry to try and resolve this issue upstream. It seeks to make content-hash omitted, so no merge conflict.

chbndrhnns · 2021-05-17T07:47:15Z

https://pypi.org/project/poetry-merge-lock/ seems archived now.
Are other known workarounds to this issue?

cjolowicz · 2021-05-22T19:34:22Z

@chbndrhnns These days I use a small shell script with these commands:

git restore --worktree --staged poetry.lock
poetry lock --no-update
git add poetry.lock

See this comment for more details.

Some annoyances & errors, doesn't seem like poetry support is fully developed. dependabot/dependabot-core#1556

tianhuil · 2023-04-01T04:11:28Z

Any updates here?

larsakerson · 2023-05-30T14:28:45Z

Any updates here? Dependabot's commits aren't honoring the python patch version specified in pyproject.toml. They consistently replace it in poetry.lock with a tilde version specification, causing build failures.

denys-marichev-sumup · 2023-06-05T09:53:03Z

Any updates here? Dependabot's commits aren't honoring the python patch version specified in pyproject.toml. They consistently replace it in poetry.lock with a tilde version specification, causing build failures.

Same problem 🥲

In my pyproject.toml file:

[tool.poetry.dependencies]
python = "3.9.16"

And Dependabot is always trying to replace the line python-versions = "3.9.16" with python-versions = "~3.9" in poetry.lock file 😟

jeffwidman · 2023-08-19T07:35:51Z

☝️ sounds like a specific bug that isn't related to this general thread of "support multiple versions of poetry/poetry.lock"...

Can you spin that off as a specific issue? I can't guarantee that we'll get to it (in fact a PR would be most welcome!) but it should be a lot more tractable to say "retain specific python pin from pyproject.toml to poetry.lock than it is to say "run with my desired poetry version"... because we should be retaining specific python pins no matter whether we stick with a single poetry version or mutliple.

cedric-spinergie · 2024-07-24T16:00:56Z

Hello!
My team and I just stumbled upon this but in the opposite direction: we need to stay on poetry 1.5.1 while the one used by dependabot is 1.8.3.

Would a "quickfix" like specifying the poetry version inside the dependabot.yml be feasible? Or maybe some place else like in the pyproject.toml.

saada · 2025-01-16T17:29:35Z

Even when using 1.8.3, we started getting 1.8.5 changes. I'm assuming dependabot just bumped their version again

ulgens · 2025-01-22T22:20:51Z

It's been 5 years, and the same issue happens between 1.8.5 and 2.0.1 now. Therhas e been a major version update and the lock file has a new version now. Github tries to revert it with each Dependabot run.

OldSneerJaw · 2025-02-02T01:28:45Z

Our build process requires the poetry export command, but it has been moved into an optional dependency in Poetry v2 (see here). There is a new tool.poetry.requires-plugins config option in v2 that lets you set your project's Poetry plugins declaratively, but because Dependabot still uses Poetry 1.8, it considers the configuration file invalid. The solution is to add plugins imperatively (instructions), but that's a nuisance because every user that needs to run that command now has to manually install the plugin.

d33bs · 2025-02-19T15:44:09Z

Just a bump to mention I ran into the same as above; using Poetry 2.x configurations (with requires-plugins config) causes Dependabot to fail. Hoping we can get a fix for this, thanks in advance!

d33bs · 2025-02-20T15:48:57Z

This issue could possibly be closed through #11642 (and more specific issues moving forward).

ulgens · 2025-02-20T20:02:22Z

@d33bs Issues like #11642 solves a different problem. Having the latest version active is important, but now there won't be a chance to use a pre-v2.0.0 version with Github and the projects that are stuck with a later version won't be able to use dependabot.

edgarrmondragon · 2025-02-20T20:05:22Z

At least starting with Poetry 2, dependabot should be able to use requires-poetry if available to install a custom Poetry version.

ulgens · 2025-02-20T20:09:19Z

@edgarrmondragon I'm not sure that parameter installs a custom Poetry version. AFAIK, it only raises an error if the requirement is not met.

edgarrmondragon · 2025-02-20T20:13:20Z

@edgarrmondragon I'm not sure that parameter installs a custom Poetry version. AFAIK, it only raises an error if the requirement is not met.

I know, but Dependabot could use that constraint to install at runtime a Poetry version the project supports.

rebelagentm added L: python:poetry Python packages via poetry T: feature-request Requests for new features labels Dec 4, 2019

cjolowicz mentioned this issue Dec 23, 2019

NonExistentKey: 'Key "hashes" does not exist #1596

Closed

callahad mentioned this issue Jan 31, 2020

Configure Dependabot or Renovate to monitor Python dependencies mdn/kuma#6175

Closed

amureki mentioned this issue Jan 31, 2020

Support multiple poetry versions #1621

Closed

rnegron mentioned this issue Feb 2, 2020

Add Dependabot support django-athm/django-athm#1

Closed

tommilligan mentioned this issue Mar 15, 2020

python: upgrade to poetry ^1.0.0 #1739

Merged

sobolevn mentioned this issue Mar 27, 2020

Bump wemake-python-styleguide from 0.13.4 to 0.14.0 wemake-services/django-test-migrations#52

Closed

infin8x added the F: language-support Issues specific to a particular language or ecosystem; may be paired with an L: label. label Jul 20, 2020

infin8x mentioned this issue Jul 20, 2020

Bump Poetry to 1.0.0 #2069

Closed

jtpavlock added a commit to MoeMusic/Moe that referenced this issue Jul 12, 2021

ci: remove dependabot

4436ab5

Some annoyances & errors, doesn't seem like poetry support is fully developed. dependabot/dependabot-core#1556

jtpavlock mentioned this issue Jul 12, 2021

ci: remove dependabot MoeMusic/Moe#100

Merged

jtpavlock added a commit to MoeMusic/Moe that referenced this issue Jul 12, 2021

ci: remove dependabot

b7438ee

Some annoyances & errors, doesn't seem like poetry support is fully developed. dependabot/dependabot-core#1556

deivid-rodriguez mentioned this issue Mar 1, 2023

Update poetry requirement from <1.4.0,>=1.1.15 to >=1.1.15,<1.5.0 in /python/helpers #6758

Closed

bhearsum mentioned this issue Mar 23, 2023

switch dependency management and package installation to poetry mozilla-releng/shipit#1304

Merged

zanieb mentioned this issue Mar 24, 2023

Add minimal dependabot configuration zanieb/poetry-relax#14

Merged

abdulapopoola added this to Dependabot Mar 28, 2023

abdulapopoola moved this to Untriaged in Dependabot Mar 30, 2023

abdulapopoola added the versioning label Mar 31, 2023

phillipuniverse mentioned this issue Jun 21, 2023

Can specify poetry version to use #7435

Closed

1 task

phillipuniverse mentioned this issue Aug 21, 2023

Add support for Poetry 1.5 lockfiles #7834

Merged

deivid-rodriguez mentioned this issue Aug 25, 2023

Poetry >=1.5.0 removes category from poetry.lock #7389

Closed

1 task

jonjanego added the Keep Exempt this from being marked by stalebot label May 2, 2024

LimpFoot2 mentioned this issue May 7, 2024

[Snyk] Upgrade web3 from 0.18.4 to 0.20.7 LimpFoot2/dependabot-core#274

Open

linglp mentioned this issue Jun 25, 2024

feat/technical debt: added trivy code scan to schematic repo Sage-Bionetworks/schematic#1448

Merged

GeckoEidechse mentioned this issue Aug 15, 2024

Add dependabot config to periodically check whether dependencies are up-to-date R2NorthstarTools/Reaper#26

Closed

d33bs mentioned this issue Feb 19, 2025

Bump poetry from 1.8.5 to 2.1.1 in /python/helpers in the poetry group across 1 directory #11638

Closed

kevinjqliu mentioned this issue Feb 22, 2025

[bug] dependabot is using Poetry 1.8.5 apache/iceberg-python#1702

Open

3 tasks

ulgens mentioned this issue Mar 13, 2025

Support updating uv.lock #10478

Open

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Poetry version support #1556

Poetry version support #1556

ulgens commented Dec 4, 2019

tommilligan commented Dec 16, 2019

sobolevn commented Dec 18, 2019 •

edited

Loading

sobolevn commented Dec 20, 2019

m-aciek commented Jan 8, 2020 •

edited

Loading

gabor-boros commented Jan 16, 2020

cjolowicz commented Feb 9, 2020

ulgens commented Mar 14, 2020 •

edited

Loading

sobolevn commented Mar 14, 2020

tommilligan commented Mar 15, 2020

tetienne commented Mar 26, 2020

sobolevn commented Mar 26, 2020

sobolevn commented Mar 26, 2020

donbowman commented Jul 11, 2020

chbndrhnns commented May 17, 2021

cjolowicz commented May 22, 2021

tianhuil commented Apr 1, 2023

larsakerson commented May 30, 2023

denys-marichev-sumup commented Jun 5, 2023 •

edited

Loading

jeffwidman commented Aug 19, 2023

cedric-spinergie commented Jul 24, 2024

saada commented Jan 16, 2025

ulgens commented Jan 22, 2025

OldSneerJaw commented Feb 2, 2025

d33bs commented Feb 19, 2025

d33bs commented Feb 20, 2025

ulgens commented Feb 20, 2025 •

edited

Loading

edgarrmondragon commented Feb 20, 2025

ulgens commented Feb 20, 2025

edgarrmondragon commented Feb 20, 2025

Poetry version support #1556

Poetry version support #1556

Comments

ulgens commented Dec 4, 2019

tommilligan commented Dec 16, 2019

sobolevn commented Dec 18, 2019 • edited Loading

sobolevn commented Dec 20, 2019

m-aciek commented Jan 8, 2020 • edited Loading

gabor-boros commented Jan 16, 2020

cjolowicz commented Feb 9, 2020

ulgens commented Mar 14, 2020 • edited Loading

sobolevn commented Mar 14, 2020

tommilligan commented Mar 15, 2020

tetienne commented Mar 26, 2020

sobolevn commented Mar 26, 2020

sobolevn commented Mar 26, 2020

donbowman commented Jul 11, 2020

chbndrhnns commented May 17, 2021

cjolowicz commented May 22, 2021

tianhuil commented Apr 1, 2023

larsakerson commented May 30, 2023

denys-marichev-sumup commented Jun 5, 2023 • edited Loading

jeffwidman commented Aug 19, 2023

cedric-spinergie commented Jul 24, 2024

saada commented Jan 16, 2025

ulgens commented Jan 22, 2025

OldSneerJaw commented Feb 2, 2025

d33bs commented Feb 19, 2025

d33bs commented Feb 20, 2025

ulgens commented Feb 20, 2025 • edited Loading

edgarrmondragon commented Feb 20, 2025

ulgens commented Feb 20, 2025

edgarrmondragon commented Feb 20, 2025

sobolevn commented Dec 18, 2019 •

edited

Loading

m-aciek commented Jan 8, 2020 •

edited

Loading

ulgens commented Mar 14, 2020 •

edited

Loading

denys-marichev-sumup commented Jun 5, 2023 •

edited

Loading

ulgens commented Feb 20, 2025 •

edited

Loading