Skip to content

fix: preserve exact Python pins in pylock exports - #375

Open
AryanRG wants to merge 1 commit into
python-poetry:mainfrom
AryanRG:fix/pylock-exact-python-pins
Open

AryanRG wants to merge 1 commit into
python-poetry:mainfrom
AryanRG:fix/pylock-exact-python-pins

Conversation

@AryanRG

@AryanRG AryanRG commented Oct 17, 2026 •

Copy link
Copy Markdown

An exact Python requirement such as ==3.13.12 currently exports as requires-python = "3.13.12" in pylock.toml. Consumers reject this because the version specifier has no operator. This affects both the project requirement and a locked package's requirement.

Poetry parses exact requirements into a Version, whose string form omits ==. Prefix that operator when serializing a Version at both locations. Add one regression parameter for each location; ranges, wildcards, unions, and marker generation keep their existing paths.

Reproduction with Python 3.13.12, Poetry 2.4.2, poetry-core 2.4.0, and uv 0.13.1:

[project]
name = "export-exact-python-repro"
version = "0.1.0"
requires-python = "==3.13.12"
dependencies = []

[tool.poetry]
package-mode = false

Run poetry lock, then poetry export -f pylock.toml -o pylock.toml. Before this change, uv pip sync pylock.toml --offline --dry-run --python /path/to/python3.13.12 exits 2 with “expected operator”. Afterward it exits 0, with requires-python = "==3.13.12". This is a dependency-free parsing/compatibility check; the dry run applies no installation or removal.

Validation on macOS with Python 3.13.12:

  • Both new regression cases fail against the base exporter and pass with the fix.
  • Full suite: 180 passed (python -m pytest -n 0 -q).
  • Mypy passed for 16 source files; Ruff lint and format checks passed.
  • Additional validation exercised 44 project/package serialization cases, including 22 exact pins and 22 unchanged non-exact constraints, plus 396 equality-membership comparisons.
  • The real Poetry CLI export and uv offline dry run above were repeated before publication.

Limits: the full OS/Python and minimum Poetry/core compatibility matrices and full pre-commit hook suite were not run locally. The real CLI/uv example covers a project pin without dependencies; package-level coverage uses exporter tests and synthetic lock metadata, rather than downloading and installing a package graph. No documentation change is proposed for this serialization correction.

AI assistance was used to prepare implementation and regression tests.

@sonarqubecloud

Copy link
Copy Markdown

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant