fix(python): parse poetry dependencies with marker-specific constraints - #11058
Open
sueun-dev wants to merge 1 commit into
Open
fix(python): parse poetry dependencies with marker-specific constraints#11058sueun-dev wants to merge 1 commit into
sueun-dev wants to merge 1 commit into
Conversation
poetry.lock records a dependency as an array of inline tables when the same package is required with different constraints per environment marker. parseDependency only handled the string and single inline-table forms, so the array form left the constraint empty and the dependency edge was silently dropped from the graph. Extract the constraint(s) in a versionRanges helper that also handles the array form.
nikpivkin
reviewed
Aug 7, 2026
Contributor
There was a problem hiding this comment.
Hi @sueun-dev !
Please open a discussion before submitting a PR, where you describe the issue and include steps to reproduce it.
| // poetry add pytest@5.4.3 --dev | ||
| // poetry show -a | awk '{gsub(/\(!\)/, ""); printf("{ID: \""$1"@"$2"\", Name: \""$1"\", Version: \""$2"\"},\n") }' | ||
| // mark dev deps | ||
| poetryMultipleConstraints = []ftypes.Package{ |
Contributor
There was a problem hiding this comment.
The comment above, which contains commands for reproduction, refers to the poetryFlask variable, so they should not be separated.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
poetry.lockrecords a dependency as an array of inline tables when the same package is required with different version constraints per environment marker:parseDependencyonly handled the plain-string form (">=1.0") and the single inline-table form ({version = "..."}). The array form decodes to[]any, matched neither case, and left the constraint empty, so the dependency edge was silently dropped from the graph. Poetry writes this form whenever a dependency is locked with different constraints per Python version or platform, so it turns up in real lockfiles.The change moves constraint extraction into a
versionRangeshelper that also handles the array form, and matches the installed version against any of the listed constraints.How I tested
Added
testdata/poetry_multiple_constraints.lockwherefoorequirestyping-extensionsvia the array form. InTestParser_Parse,foo'sdependsOnis missing that edge before the change;TestParseDependencygets the array case too. Both fail before and pass after.Checklist