consider dependency-groups in lockfile hash#10621
Merged
radoering merged 2 commits intopython-poetry:mainfrom Nov 21, 2025
Merged
consider dependency-groups in lockfile hash#10621radoering merged 2 commits intopython-poetry:mainfrom
radoering merged 2 commits intopython-poetry:mainfrom
Conversation
Reviewer's GuideThis PR updates the lockfile hash and freshness logic to incorporate the new dependency-groups section while preserving backward compatibility with older Poetry versions, and extends the test suite to validate hashing and freshness behavior across both legacy and new configurations. Sequence diagram for lockfile freshness check with dependency-groups and version fallbacksequenceDiagram
participant Locker
participant Lockfile
participant "Poetry Version Parser"
Locker->>Lockfile: open lockfile and read first line
Locker->>"Poetry Version Parser": extract Poetry version from comment
alt Poetry version < 2.3.0
Locker->>Locker: _get_content_hash(with_dependency_groups=False)
Locker->>Lockfile: compare old_content_hash to lockfile hash
else Poetry version >= 2.3.0
Locker->>Locker: _get_content_hash(with_dependency_groups=True)
Locker->>Lockfile: compare content_hash to lockfile hash
end
File-Level Changes
Assessment against linked issues
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
There was a problem hiding this comment.
Hey there - I've reviewed your changes and they look great!
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location> `src/poetry/packages/locker.py:291-301` </location>
<code_context>
self._lock_data = None
- def _get_content_hash(self) -> str:
+ def _get_content_hash(self, *, with_dependency_groups: bool = True) -> str:
"""
Returns the sha256 hash of the sorted content of the pyproject file.
</code_context>
<issue_to_address>
**suggestion:** Consider documenting the new 'with_dependency_groups' parameter for clarity.
Documenting how this parameter affects hash calculation will help maintainers understand its role and ensure backward compatibility.
```suggestion
def _get_content_hash(self, *, with_dependency_groups: bool = True) -> str:
"""
Returns the sha256 hash of the sorted content of the pyproject file.
Args:
with_dependency_groups (bool, optional): If True (default), includes the
'dependency-groups' section from the pyproject file in the hash calculation.
If False, excludes 'dependency-groups' from the hash. This can be used to
control whether changes to dependency groups affect the content hash.
Returns:
str: The sha256 hash of the relevant pyproject content.
"""
project_content = self._pyproject_data.get("project", {})
group_content = (
self._pyproject_data.get("dependency-groups", {})
if with_dependency_groups
else {}
)
tool_poetry_content = self._pyproject_data.get("tool", {}).get("poetry", {})
```
</issue_to_address>
### Comment 2
<location> `src/poetry/packages/locker.py:109` </location>
<code_context>
def is_fresh(self) -> bool:
"""
Checks whether the lock file is still up to date with the current hash.
"""
with self.lock.open("rb") as f:
lock = tomllib.load(f)
metadata = lock.get("metadata", {})
if "content-hash" in metadata:
fresh: bool = self._content_hash == metadata["content-hash"]
if not fresh:
with self.lock.open("r", encoding="utf-8") as f:
generated_comment = f.readline()
if m := re.search("Poetry ([^ ]+)", generated_comment):
try:
version = Version.parse(m.group(1))
except InvalidVersionError:
pass
else:
if version < Version.parse("2.3.0"):
# Before Poetry 2.3.0, the content hash did not include
# dependency groups, so we need to recompute it without
# them for comparison.
old_content_hash = self._get_content_hash(
with_dependency_groups=False
)
fresh = old_content_hash == metadata["content-hash"]
return fresh
return False
</code_context>
<issue_to_address>
**suggestion (code-quality):** Replace m.group(x) with m[x] for re.Match objects ([`use-getitem-for-re-match-groups`](https://docs.sourcery.ai/Reference/Default-Rules/suggestions/use-getitem-for-re-match-groups/))
```suggestion
version = Version.parse(m[1])
```
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Secrus
approved these changes
Nov 20, 2025
a475bd1 to
2e8ab24
Compare
Closed
|
This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request Check List
Resolves: #10598
Unfortunately, just considering dependency-groups has the following effects:
I handled the first issue in the second commit. I assume it is controversial if this should be addressed at all. I decided to do it to make the update process smoother and avoid failing pipelines.
I think we have to accept the second issue. (I think we just should not include this fix in a micro release but in a minor release.)
By the way, I extended the tests for changes to the hash function significantly because it is critical for backwards compatibility that the hash does not change if a new field is not used.
Summary by Sourcery
Include dependency-groups in the lockfile content hash while preserving backward compatibility with pre-2.3.0 Poetry by allowing recomputation of the hash without dependency-groups and updating tests accordingly
New Features:
Enhancements:
Tests: