Poetry version support #1556

ulgens · 2019-12-04T10:08:42Z

Dependabot supports Poetry but it doesn't use given version in pyproject.toml file. When i use any version newer than 1.0.0a1, update check fails because of changed lock file syntax.

tommilligan · 2019-12-16T09:13:52Z

Would also be interested in this. Just upgraded to the newly released poetry v1 and getting the error:

updater | ERROR <job_17789943> Error processing tld (Dependabot::SharedHelpers::HelperSubprocessFailed)
updater | ERROR <job_17789943>                                   
updater | <job_17789943> [NonExistentKey]   
updater | <job_17789943> 'Key "hashes" does not exist.'  
updater | <job_17789943>                                   
updater | <job_17789943> update [--no-dev] [--dry-run] [--lock] [--] [<packages>]...
updater | <job_17789943>

sobolevn · 2019-12-18T08:30:30Z

I am all in for this change!

Repo that has this problem: https://github.com/wemake-services/wemake-python-styleguide/blob/master/pyproject.toml

Poetry version is specified in the build file:

[build-system]
requires = ["poetry>=1.0"]
build-backend = "poetry.masonry.api"

But, it does not work. What website says:

Logs:

updater | ERROR <job_18040832> Error processing astboom (Dependabot::SharedHelpers::HelperSubprocessFailed)
updater | ERROR <job_18040832>                                   
updater | <job_18040832> [NonExistentKey]   
updater | <job_18040832> 'Key "hashes" does not exist.'  
updater | <job_18040832>                                   
updater | <job_18040832> update [--no-dev] [--dry-run] [--lock] [--] [<packages>]...
updater | <job_18040832> 
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-python-0.113.28/lib/dependabot/python/update_checker/poetry_version_resolver.rb:319:in `run_poetry_command'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-python-0.113.28/lib/dependabot/python/update_checker/poetry_version_resolver.rb:85:in `block (2 levels) in fetch_latest_resolvable_version_string'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/shared_helpers.rb:143:in `with_git_configured'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-python-0.113.28/lib/dependabot/python/update_checker/poetry_version_resolver.rb:73:in `block in fetch_latest_resolvable_version_string'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/shared_helpers.rb:37:in `block (2 levels) in in_a_temporary_directory'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/shared_helpers.rb:37:in `chdir'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/shared_helpers.rb:37:in `block in in_a_temporary_directory'
updater | ERROR <job_18040832> /usr/lib/ruby/2.6.0/tmpdir.rb:93:in `mktmpdir'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/shared_helpers.rb:34:in `in_a_temporary_directory'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-python-0.113.28/lib/dependabot/python/update_checker/poetry_version_resolver.rb:72:in `fetch_latest_resolvable_version_string'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-python-0.113.28/lib/dependabot/python/update_checker/poetry_version_resolver.rb:42:in `latest_resolvable_version'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-python-0.113.28/lib/dependabot/python/update_checker.rb:43:in `latest_resolvable_version'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/update_checkers/base.rb:70:in `preferred_resolvable_version'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/update_checkers/base.rb:233:in `preferred_version_resolvable_with_unlock?'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/update_checkers/base.rb:225:in `numeric_version_can_update?'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/update_checkers/base.rb:175:in `version_can_update?'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/vendor/ruby/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/update_checkers/base.rb:38:in `can_update?'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/lib/dependabot/updater.rb:208:in `requirements_to_unlock'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/lib/dependabot/updater.rb:159:in `check_and_create_pull_request'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/lib/dependabot/updater.rb:62:in `check_and_create_pr_with_error_handling'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/lib/dependabot/updater.rb:48:in `block in run'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/lib/dependabot/updater.rb:48:in `each'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/lib/dependabot/updater.rb:48:in `run'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/lib/dependabot/update_files_job.rb:16:in `perform_job'
updater | ERROR <job_18040832> /home/dependabot/dependabot-updater/lib/dependabot/base_job.rb:29:in `run'
updater | ERROR <job_18040832> bin/update_files.rb:21:in `<main>'

In case making a support for several versions is a hard thing, then I suggest to drop poetry@0.x support in favour of poetry@1.x support. Because update process is easy for developers.

sobolevn · 2019-12-20T05:53:47Z

At this point I have upgraded almost all my packages to poetry@1.0 and dependabot almost stoped working to me 😞

m-aciek · 2020-01-08T09:31:57Z

Related pull requests: #1571, #1623, #1624. Related issue on feedback repo: https://github.com/dependabot/feedback/issues/798.

gabor-boros · 2020-01-16T14:56:49Z

Any update on this?

cjolowicz · 2020-02-09T09:45:29Z

The automated pull request for Poetry 1.0.3 is here: #1667

Note: this is supposed to be working automatically with dependabot, but there's an outstanding issue yet to be resolved at dependabot/dependabot-core#1556 Hopefully this gets resolved soon.

ulgens · 2020-03-14T04:10:12Z

#1710

~~Does anyone have any idea why this test fails?~~

Tests are failing because dependabot can't parse new lock file format. Any Ruby developers to help with it? 🤕

sobolevn · 2020-03-14T08:39:59Z

dependendabot is not working for me for almost 4 month now. Sadly, but there's nothing I can do about it.

tommilligan · 2020-03-15T19:01:47Z

@ulgens I've submitted PR #1739, which fixes the failing tests you mentioned. The fix is only in the tests themselves, so hopefully should be a quick review.

tetienne · 2020-03-26T09:43:06Z

Issue is now solved.

sobolevn · 2020-03-26T11:40:32Z

Not fully. There are several issues:

I got a lot of spam like this: https://github.com/wemake-services/wemake-python-styleguide/issues?q=is%3Aissue+author%3Aapp%2Fdependabot-preview+is%3Aclosed
Every dependency update has merge conflicts. Because of the [metadata].content-hash field: https://github.com/wemake-services/wemake-python-styleguide/pull/1287/files#diff-41fe8bebc1a2a52eb5321b759e40b3a8R1627 Now all merge must be done like: merge first -> rebase second -> merge second. I guess it is a problem with poetry. Here's the upstream issue: Make the lock file more merge-friendly python-poetry/poetry#496

There's a workaround for the second problem: https://pypi.org/project/poetry-merge-lock/

sobolevn · 2020-03-26T12:07:45Z

Also dependabot cannot update my deps, here's what it says: wemake-services/wemake-python-styleguide#1286 (comment)

Note: this is supposed to be working automatically with dependabot, but there's an outstanding issue yet to be resolved at dependabot/dependabot-core#1556 Hopefully this gets resolved soon.

donbowman · 2020-07-11T16:11:49Z

Not fully. There are several issues:

I got a lot of spam like this: https://github.com/wemake-services/wemake-python-styleguide/issues?q=is%3Aissue+author%3Aapp%2Fdependabot-preview+is%3Aclosed

Every dependency update has merge conflicts. Because of the [metadata].content-hash field: https://github.com/wemake-services/wemake-python-styleguide/pull/1287/files#diff-41fe8bebc1a2a52eb5321b759e40b3a8R1627 Now all merge must be done like: merge first -> rebase second -> merge second. I guess it is a problem with poetry. Here's the upstream issue: python-poetry/poetry#496

There's a workaround for the second problem: https://pypi.org/project/poetry-merge-lock/

python-poetry/poetry#2654 is my PR to poetry to try and resolve this issue upstream. It seeks to make content-hash omitted, so no merge conflict.

chbndrhnns · 2021-05-17T07:47:15Z

https://pypi.org/project/poetry-merge-lock/ seems archived now.
Are other known workarounds to this issue?

cjolowicz · 2021-05-22T19:34:22Z

@chbndrhnns These days I use a small shell script with these commands:

git restore --worktree --staged poetry.lock
poetry lock --no-update
git add poetry.lock

See this comment for more details.

Some annoyances & errors, doesn't seem like poetry support is fully developed. dependabot/dependabot-core#1556

deivid-rodriguez · 2023-01-11T19:35:25Z

I agree with you, I was just sharing the only workaround on our side that I could think of at the moment that does not involve poetry itself recording the version/requirement somehow.

xmnlab · 2023-02-07T16:33:37Z

hi everyone! is this issue still a problem or was it already fixed?

deivid-rodriguez · 2023-02-07T16:36:49Z

Still a problem I think. There's been no movement here, so I don't expect this to have been fixed.

xmnlab · 2023-02-07T16:43:36Z

@deivid-rodriguez, thanks for the quick response!

ulgens · 2023-02-09T11:19:06Z

Yep, still a problem.

d3QUone · 2023-02-24T16:05:41Z

Hi team! Any updates here?

deivid-rodriguez · 2023-02-24T16:46:06Z

No news @d3QUone. I will post an update when there's something to share.

tianhuil · 2023-04-01T04:11:28Z

Any updates here?

larsakerson · 2023-05-30T14:28:45Z

Any updates here? Dependabot's commits aren't honoring the python patch version specified in pyproject.toml. They consistently replace it in poetry.lock with a tilde version specification, causing build failures.

denys-marichev-sumup · 2023-06-05T09:53:03Z

Any updates here? Dependabot's commits aren't honoring the python patch version specified in pyproject.toml. They consistently replace it in poetry.lock with a tilde version specification, causing build failures.

Same problem 🥲

In my pyproject.toml file:

[tool.poetry.dependencies]
python = "3.9.16"

And Dependabot is always trying to replace the line python-versions = "3.9.16" with python-versions = "~3.9" in poetry.lock file 😟

jeffwidman · 2023-08-19T07:35:51Z

☝️ sounds like a specific bug that isn't related to this general thread of "support multiple versions of poetry/poetry.lock"...

Can you spin that off as a specific issue? I can't guarantee that we'll get to it (in fact a PR would be most welcome!) but it should be a lot more tractable to say "retain specific python pin from pyproject.toml to poetry.lock than it is to say "run with my desired poetry version"... because we should be retaining specific python pins no matter whether we stick with a single poetry version or mutliple.

cedric-spinergie · 2024-07-24T16:00:56Z

Hello!
My team and I just stumbled upon this but in the opposite direction: we need to stay on poetry 1.5.1 while the one used by dependabot is 1.8.3.

Would a "quickfix" like specifying the poetry version inside the dependabot.yml be feasible? Or maybe some place else like in the pyproject.toml.

saada · 2025-01-16T17:29:35Z

Even when using 1.8.3, we started getting 1.8.5 changes. I'm assuming dependabot just bumped their version again

ulgens · 2025-01-22T22:20:51Z

It's been 5 years, and the same issue happens between 1.8.5 and 2.0.1 now. Therhas e been a major version update and the lock file has a new version now. Github tries to revert it with each Dependabot run.

rebelagentm added L: python:poetry Python packages via poetry T: feature-request Requests for new features labels Dec 4, 2019

cjolowicz mentioned this issue Dec 23, 2019

NonExistentKey: 'Key "hashes" does not exist #1596

Closed

callahad mentioned this issue Jan 31, 2020

Configure Dependabot or Renovate to monitor Python dependencies mdn/kuma#6175

Closed

amureki mentioned this issue Jan 31, 2020

Support multiple poetry versions #1621

Closed

rnegron mentioned this issue Feb 2, 2020

Add Dependabot support django-athm/django-athm#1

Closed

tommilligan mentioned this issue Mar 15, 2020

python: upgrade to poetry ^1.0.0 #1739

Merged

sobolevn mentioned this issue Mar 27, 2020

Bump wemake-python-styleguide from 0.13.4 to 0.14.0 wemake-services/django-test-migrations#52

Closed

infin8x added the F: language-support Issues specific to a particular language or ecosystem; may be paired with an L: label. label Jul 20, 2020

infin8x mentioned this issue Jul 20, 2020

Bump Poetry to 1.0.0 #2069

Closed

jtpavlock added a commit to MoeMusic/Moe that referenced this issue Jul 12, 2021

ci: remove dependabot

4436ab5

Some annoyances & errors, doesn't seem like poetry support is fully developed. dependabot/dependabot-core#1556

jtpavlock mentioned this issue Jul 12, 2021

ci: remove dependabot MoeMusic/Moe#100

Merged

jtpavlock added a commit to MoeMusic/Moe that referenced this issue Jul 12, 2021

ci: remove dependabot

b7438ee

Some annoyances & errors, doesn't seem like poetry support is fully developed. dependabot/dependabot-core#1556

DMRobertson mentioned this issue Jan 16, 2023

RFC: how to deal with poetry 1.3's new lockfile format matrix-org/synapse#14857

Closed

rcaneill mentioned this issue Feb 11, 2023

Bump ipython from 8.7.0 to 8.10.0 rcaneill/xnemogcm#39

Closed

justinpolygon mentioned this issue Mar 1, 2023

Fix for failing dependabot PRs polygon-io/client-python#395

Merged

deivid-rodriguez mentioned this issue Mar 1, 2023

Update poetry requirement from <1.4.0,>=1.1.15 to >=1.1.15,<1.5.0 in /python/helpers #6758

Closed

bhearsum mentioned this issue Mar 23, 2023

switch dependency management and package installation to poetry mozilla-releng/shipit#1304

Merged

zanieb mentioned this issue Mar 24, 2023

Add minimal dependabot configuration zanieb/poetry-relax#14

Merged

abdulapopoola added this to Dependabot Mar 28, 2023

abdulapopoola moved this to Untriaged in Dependabot Mar 30, 2023

abdulapopoola added the versioning label Mar 31, 2023

phillipuniverse mentioned this issue Jun 21, 2023

Can specify poetry version to use #7435

Closed

1 task

phillipuniverse mentioned this issue Aug 21, 2023

Add support for Poetry 1.5 lockfiles #7834

Merged

deivid-rodriguez mentioned this issue Aug 25, 2023

Poetry >=1.5.0 removes category from poetry.lock #7389

Closed

1 task

jonjanego added the Keep Exempt this from being marked by stalebot label May 2, 2024

LimpFoot2 mentioned this issue May 7, 2024

[Snyk] Upgrade web3 from 0.18.4 to 0.20.7 LimpFoot2/dependabot-core#274

Open

linglp mentioned this issue Jun 25, 2024

feat/technical debt: added trivy code scan to schematic repo Sage-Bionetworks/schematic#1448

Merged

GeckoEidechse mentioned this issue Aug 15, 2024

Add dependabot config to periodically check whether dependencies are up-to-date R2NorthstarTools/Reaper#26

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Poetry version support #1556

Poetry version support #1556

ulgens commented Dec 4, 2019

tommilligan commented Dec 16, 2019

sobolevn commented Dec 18, 2019 •

edited

Loading

sobolevn commented Dec 20, 2019

m-aciek commented Jan 8, 2020 •

edited

Loading

gabor-boros commented Jan 16, 2020

cjolowicz commented Feb 9, 2020

ulgens commented Mar 14, 2020 •

edited

Loading

sobolevn commented Mar 14, 2020

tommilligan commented Mar 15, 2020

tetienne commented Mar 26, 2020

sobolevn commented Mar 26, 2020

sobolevn commented Mar 26, 2020

donbowman commented Jul 11, 2020

chbndrhnns commented May 17, 2021

cjolowicz commented May 22, 2021

deivid-rodriguez commented Jan 11, 2023

xmnlab commented Feb 7, 2023

deivid-rodriguez commented Feb 7, 2023

xmnlab commented Feb 7, 2023

ulgens commented Feb 9, 2023

d3QUone commented Feb 24, 2023

deivid-rodriguez commented Feb 24, 2023

tianhuil commented Apr 1, 2023

larsakerson commented May 30, 2023

denys-marichev-sumup commented Jun 5, 2023 •

edited

Loading

jeffwidman commented Aug 19, 2023

cedric-spinergie commented Jul 24, 2024

saada commented Jan 16, 2025

ulgens commented Jan 22, 2025

Poetry version support #1556

Poetry version support #1556

Comments

ulgens commented Dec 4, 2019

tommilligan commented Dec 16, 2019

sobolevn commented Dec 18, 2019 • edited Loading

sobolevn commented Dec 20, 2019

m-aciek commented Jan 8, 2020 • edited Loading

gabor-boros commented Jan 16, 2020

cjolowicz commented Feb 9, 2020

ulgens commented Mar 14, 2020 • edited Loading

sobolevn commented Mar 14, 2020

tommilligan commented Mar 15, 2020

tetienne commented Mar 26, 2020

sobolevn commented Mar 26, 2020

sobolevn commented Mar 26, 2020

donbowman commented Jul 11, 2020

chbndrhnns commented May 17, 2021

cjolowicz commented May 22, 2021

deivid-rodriguez commented Jan 11, 2023

xmnlab commented Feb 7, 2023

deivid-rodriguez commented Feb 7, 2023

xmnlab commented Feb 7, 2023

ulgens commented Feb 9, 2023

d3QUone commented Feb 24, 2023

deivid-rodriguez commented Feb 24, 2023

tianhuil commented Apr 1, 2023

larsakerson commented May 30, 2023

denys-marichev-sumup commented Jun 5, 2023 • edited Loading

jeffwidman commented Aug 19, 2023

cedric-spinergie commented Jul 24, 2024

saada commented Jan 16, 2025

ulgens commented Jan 22, 2025

sobolevn commented Dec 18, 2019 •

edited

Loading

m-aciek commented Jan 8, 2020 •

edited

Loading

ulgens commented Mar 14, 2020 •

edited

Loading

denys-marichev-sumup commented Jun 5, 2023 •

edited

Loading