package category is not useful #7637
Conversation
|
the continuing entanglement of this repository with poetry-plugin-export seems to make python-poetry/poetry-plugin-export#188 a prerequisite for merging this. It sure would be nice to get #5980 done |
|
For correctness we should do a minor bump of the lock file version, shouldn't we? On the other side, users with an older version of poetry will get the warning |
|
I don't think a version bump is necessary - afaics all versions of poetry from 1.2.0 onwards default the category (versions earlier than that already can't read the current lockfile format) ie the claim is that the 'category' has been optional for some time already, this MR is just choosing not to write it. having said which I don't particularly mind a version bump if you prefer one anyway. |
dimbleby
force-pushed
the
remove-category
branch
from
118d865
to
ae3c1fc
Compare
dimbleby
force-pushed
the
remove-category
branch
3 times, most recently
from
a232ed9
to
bb71c0b
Compare
dimbleby
force-pushed
the
remove-category
branch
from
bb71c0b
to
58bf0d9
Compare
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [poetry](https://python-poetry.org/) ([source](https://github.com/python-poetry/poetry), [changelog](https://python-poetry.org/history/)) | minor | `1.4.2` -> `1.5.0` | --- ### Release Notes <details> <summary>python-poetry/poetry</summary> ### [`v1.5.0`](https://github.com/python-poetry/poetry/blob/HEAD/CHANGELOG.md#​150---2023-05-19) [Compare Source](python-poetry/poetry@1.4.2...1.5.0) ##### Added - **Introduce the new source priorities `explicit` and `supplemental`** ([#​7658](python-poetry/poetry#7658), [#​6879](python-poetry/poetry#6879)). - **Introduce the option to configure the priority of the implicit PyPI source** ([#​7801](python-poetry/poetry#7801)). - Add handling for corrupt cache files ([#​7453](python-poetry/poetry#7453)). - Improve caching of URL and git dependencies ([#​7693](python-poetry/poetry#7693), [#​7473](python-poetry/poetry#7473)). - Add option to skip installing directory dependencies ([#​6845](python-poetry/poetry#6845), [#​7923](python-poetry/poetry#7923)). - Add `--executable` option to `poetry env info` ([#​7547](python-poetry/poetry#7547)). - Add `--top-level` option to `poetry show` ([#​7415](python-poetry/poetry#7415)). - Add `--lock` option to `poetry remove` ([#​7917](python-poetry/poetry#7917)). - Add experimental `POETRY_REQUESTS_TIMEOUT` option ([#​7081](python-poetry/poetry#7081)). - Improve performance of wheel inspection by avoiding unnecessary file copy operations ([#​7916](python-poetry/poetry#7916)). ##### Changed - **Remove the old deprecated installer and the corresponding setting `experimental.new-installer`** ([#​7356](python-poetry/poetry#7356)). - **Introduce `priority` key for sources and deprecate flags `default` and `secondary`** ([#​7658](python-poetry/poetry#7658)). - Deprecate `poetry run <entry point>` if the entry point was not previously installed via `poetry install` ([#​7606](python-poetry/poetry#7606)). - Only write the lock file if the installation succeeds ([#​7498](python-poetry/poetry#7498)). - Do not write the unused package category into the lock file ([#​7637](python-poetry/poetry#7637)). ##### Fixed - Fix an issue where Poetry's internal pyproject.toml continually grows larger with empty lines ([#​7705](python-poetry/poetry#7705)). - Fix an issue where Poetry crashes due to corrupt cache files ([#​7453](python-poetry/poetry#7453)). - Fix an issue where the `Retry-After` in HTTP responses was not respected and retries were handled inconsistently ([#​7072](python-poetry/poetry#7072)). - Fix an issue where Poetry silently ignored invalid groups ([#​7529](python-poetry/poetry#7529)). - Fix an issue where Poetry does not find a compatible Python version if not given explicitly ([#​7771](python-poetry/poetry#7771)). - Fix an issue where the `direct_url.json` of an editable install from a git dependency was invalid ([#​7473](python-poetry/poetry#7473)). - Fix an issue where error messages from build backends were not decoded correctly ([#​7781](python-poetry/poetry#7781)). - Fix an infinite loop when adding certain dependencies ([#​7405](python-poetry/poetry#7405)). - Fix an issue where pre-commit hooks skip pyproject.toml files in subdirectories ([#​7239](python-poetry/poetry#7239)). - Fix an issue where pre-commit hooks do not use the expected Python version ([#​6989](python-poetry/poetry#6989)). - Fix an issue where an unclear error message is printed if the project name is the same as one of its dependencies ([#​7757](python-poetry/poetry#7757)). - Fix an issue where `poetry install` returns a zero exit status even though the build script failed ([#​7812](python-poetry/poetry#7812)). - Fix an issue where an existing `.venv` was not used if `in-project` was not set ([#​7792](python-poetry/poetry#7792)). - Fix an issue where multiple extras passed to `poetry add` were not parsed correctly ([#​7836](python-poetry/poetry#7836)). - Fix an issue where `poetry shell` did not send a newline to `fish` ([#​7884](python-poetry/poetry#7884)). - Fix an issue where `poetry update --lock` printed operations that were not executed ([#​7915](python-poetry/poetry#7915)). - Fix an issue where `poetry add --lock` did perform a full update of all dependencies ([#​7920](python-poetry/poetry#7920)). - Fix an issue where `poetry shell` did not work with `nushell` ([#​7919](python-poetry/poetry#7919)). - Fix an issue where subprocess calls failed on Python 3.7 ([#​7932](python-poetry/poetry#7932)). - Fix an issue where keyring was called even though the password was stored in an environment variable ([#​7928](python-poetry/poetry#7928)). ##### Docs - Add information about what to use instead of `--dev` ([#​7647](python-poetry/poetry#7647)). - Promote semantic versioning less aggressively ([#​7517](python-poetry/poetry#7517)). - Explain Poetry's own versioning scheme in the FAQ ([#​7517](python-poetry/poetry#7517)). - Update documentation for configuration with environment variables ([#​6711](python-poetry/poetry#6711)). - Add details how to disable the virtualenv prompt ([#​7874](python-poetry/poetry#7874)). - Improve documentation on whether to commit `poetry.lock` ([#​7506](python-poetry/poetry#7506)). - Improve documentation of `virtualenv.create` ([#​7608](python-poetry/poetry#7608)). ##### poetry-core ([`1.6.0`](https://github.com/python-poetry/poetry-core/releases/tag/1.6.0)) - Improve error message for invalid markers ([#​569](python-poetry/poetry-core#569)). - Increase robustness when deleting temporary directories on Windows ([#​460](python-poetry/poetry-core#460)). - Replace `tomlkit` with `tomli`, which changes the interface of some *internal* classes ([#​483](python-poetry/poetry-core#483)). - Deprecate `Package.category` ([#​561](python-poetry/poetry-core#561)). - Fix a performance regression in marker handling ([#​568](python-poetry/poetry-core#568)). - Fix an issue where wildcard version constraints were not handled correctly ([#​402](python-poetry/poetry-core#402)). - Fix an issue where `poetry build` created duplicate Python classifiers if they were specified manually ([#​578](python-poetry/poetry-core#578)). - Fix an issue where local versions where not handled correctly ([#​579](python-poetry/poetry-core#579)). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNS44Mi4wIiwidXBkYXRlZEluVmVyIjoiMzUuODIuMCIsInRhcmdldEJyYW5jaCI6Im1hc3RlciJ9--> Reviewed-on: https://git.walbeck.it/walbeck-it/docker-python-poetry/pulls/717 Co-authored-by: renovate-bot <[email protected]> Co-committed-by: renovate-bot <[email protected]>
|
I just want to note for the record that this change led to a fair amount of downstream breakage. GitHub's Dependabot poetry lockfile parsing broke for weeks (dependabot/dependabot-core#7418) and PyUp Safety is still broken (pyupio/safety#479) - there are probably others. I think as Poetry has become rightly widespread, predictability of file formats is becoming more important. I don't know what the right solution is to mitigate such breakage (more strict semantic versioning? longer deprecation timelines/warnings?) but as a downstream user affected by both breakages I did want to at least note it. |
|
poetry's lockfile has never been part of its API: it's an internal implementation detail. if you know of projects that rely on its format - please encourage them not to do so! |
|
I would suggest reviewing whether that stance is sustainable. GitHub's Dependabot, for example, is hardly a minor third party use case - it's a project many thousands of repositories rely on to monitor their projects for security vulnerabilities. And I don't see how it can do its job without parsing the lockfile, after all, it's only the lockfile that gives a vulnerability analysis tool like Dependabot the exact information it needs to know whether the actually used versions of dependencies are vulnerable. |
|
This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs. |
companion to python-poetry/poetry-core#561