Skip to content

Comments

fix(solver): do not choose a (locked) package from an explicit source for a dependency that does not allow an explicit source#10324

Merged
radoering merged 1 commit intopython-poetry:mainfrom
radoering:locked-from-explicit-source
Apr 26, 2025
Merged

fix(solver): do not choose a (locked) package from an explicit source for a dependency that does not allow an explicit source#10324
radoering merged 1 commit intopython-poetry:mainfrom
radoering:locked-from-explicit-source

Conversation

@radoering
Copy link
Member

@radoering radoering commented Apr 6, 2025 •
edited by sourcery-ai bot
Loading

Pull Request Check List

Resolves: #10315

  • Added tests for changed code.
  • Updated documentation for changed code.

Summary by Sourcery

Improve package source selection logic in the solver to handle complex dependency scenarios with explicit sources

Bug Fixes:

  • Prevent choosing a package from an explicit source when the dependency does not explicitly allow it

Tests:

  • Add a comprehensive test case to verify package source selection behavior with multiple constraints and locked packages

@sourcery-ai
Copy link

sourcery-ai bot commented Apr 6, 2025 •
edited
Loading

Reviewer's Guide by Sourcery

This pull request fixes an issue in the solver where it could incorrectly choose a locked package from an explicit source for a dependency that does not allow an explicit source. A test case has been added to verify the fix.

No diagrams generated as the changes look simple and do not need a visual representation.

File-Level Changes

Change Details Files
Added a test case to verify that the solver correctly handles scenarios where a dependency has multiple constraints, one of which requires an explicit source while another does not.
  • Added a new test case test_multiple_constraints_incomplete_explicit_source_transitive_locked to tests/puzzle/test_solver.py.
  • The test case covers both locked and unlocked scenarios.
  • The test case sets up a scenario where the root package depends on lib with different constraints based on the platform, and other which in turn depends on lib.
  • The test verifies that the solver chooses the correct version of lib from the appropriate source based on the constraints and priorities.
 tests/puzzle/test_solver.py
Modified the get_locked method in Provider to prevent the solver from incorrectly choosing a locked package from an explicit source when the dependency does not allow an explicit source.
  • Added a check to ensure that if a dependency does not have a specified source name, and a locked package is from an explicit source, the package is skipped.
  • This prevents the solver from picking a package from an explicit source for a dependency that should be resolved from the default source.
 src/poetry/puzzle/provider.py

Possibly linked issues

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!
  • Generate a plan of action for an issue: Comment @sourcery-ai plan on
    an issue to generate a plan of action for it.

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

sourcery-ai[bot]
sourcery-ai bot reviewed Apr 6, 2025
View reviewed changes
Copy link

@sourcery-ai sourcery-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @radoering - I've reviewed your changes - here's some feedback:

Overall Comments:

  • The new test case is quite complex; consider adding some comments to explain the different scenarios being tested.
  • The code change looks good, but it might be worth adding a comment explaining why the continue statement is necessary.
Here's what I looked at during the review
  • 🟢 General issues: all looks good
  • 🟢 Security: all looks good
  • 🟢 Testing: all looks good
  • 🟢 Complexity: all looks good
  • 🟢 Documentation: all looks good
Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

@radoering radoering mentioned this pull request Apr 6, 2025
Closed
@radoering radoering requested a review from a team April 11, 2025 15:40
@radoering radoering force-pushed the locked-from-explicit-source branch 2 times, most recently from 0e62626 to 642f00e Compare April 20, 2025 09:07
@radoering
fix(solver): do not choose a (locked) package from an explicit source…
eea1597 
… for a dependency that does not allow an explicit source
@radoering radoering force-pushed the locked-from-explicit-source branch from 642f00e to eea1597 Compare April 25, 2025 14:24
@radoering radoering merged commit d447030 into python-poetry:main Apr 26, 2025
53 checks passed
@radoering radoering mentioned this pull request May 4, 2025
Merged
@github-actions
Copy link

github-actions bot commented May 27, 2025

This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators May 27, 2025
@radoering radoering deleted the locked-from-explicit-source branch December 13, 2025 17:12
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@sourcery-ai sourcery-ai[bot] sourcery-ai[bot] left review comments

@Secrus Secrus Secrus approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Re-locking fails with transitive dependency from alternative source

2 participants

@radoering @Secrus