• Poetry version: 1.5.1
• Python version: 3.11
• OS version and name: Debian GNU/Linux 12 (bookworm)
• pyproject.toml: https://github.com/aucampia/issues/blob/ba53b364209e4d334bf8fc219f4667b6db8d287b/20230713-poetry-prerelease-backdoor/pyproject.toml
• poetry.lock: https://github.com/aucampia/issues/blob/ba53b364209e4d334bf8fc219f4667b6db8d287b/20230713-poetry-prerelease-backdoor/poetry.lock

• I am on the latest stable Poetry version, installed using a recommended method.
• I have searched the issues of this repo and believe that this is not a duplicate.
• I have consulted the FAQ and blog for any relevant entries or release notes.
• If an exception occurs when executing a command, I executed it again in debug mode (-vvv option) and have included the output below.

Issue

With the linked poetry.lock and pyproject.toml, when I run poetry update sqlparse, poetry upgrades dbt-postgres to a pre-release version even though the pyproject.toml file has dbt-postgres = {version = "^1.5.2", allow-prereleases = false} (the default).

See below:

$ poetry update sqlparse
Updating dependencies
Resolving dependencies... (0.6s)

Package operations: 0 installs, 7 updates, 4 removals

  • Removing jsonschema-specifications (2023.6.1)
  • Removing referencing (0.29.1)
  • Removing rpds-py (0.8.10)
  • Removing werkzeug (2.3.6)
  • Updating typing-extensions (4.7.1 -> 4.6.3)
  • Updating urllib3 (2.0.3 -> 1.26.16)
  • Updating jsonschema (4.18.2 -> 3.2.0)
  • Updating mashumaro (3.6 -> 3.8.1)
  • Updating sqlparse (0.4.3 -> 0.4.4)
  • Updating dbt-core (1.5.2 -> 1.6.0b8)
  • Updating dbt-postgres (1.5.2 -> 1.6.0b8)

Writing lock file

This can be reproduced by running docker compose build in this directory. The output of doing this can be seen in here.