pre-commit-hooks-safety icon indicating copy to clipboard operation
pre-commit-hooks-safety copied to clipboard

'extra' poetry dependencies are not checked

Open yrro opened this issue 2 years ago • 1 comments

I just noticed that convert_poetry_to_requirements works by running poetry export --with=dev and feeding the output to safety check.

When a project has 'extra' dependencies, they are not included in the output of poetry export --with-dev.

Here's a demonstration using https://github.com/yrro/hitron-exporter/:

$ poetry export --with=dev | grep '^[^ ]' | wc -l
30

$ poetry export --with=dev -E freeipa-vault -E container | grep '^[^ ]' | wc -l
48

Unfortunately poetry export dosn't have a way to include all extra dependencies; you probably have to parse pyproject.toml and construct the list of extras by looking for this part:

[tool.poetry.extras]
freeipa-vault = ["ipaclient", "ipapython"]
container = ["gunicorn", "setproctitle"]

yrro avatar Feb 18 '23 17:02 yrro

@yrro thanks for the report

That's indeed a limitation when using poetry. Related issue: https://github.com/python-poetry/poetry-plugin-export/issues/45

I'd prefer not to include some pyproject.toml-parsing logic in this tool, and wait for Poetry to support --all.

Lucas-C avatar Feb 19 '23 16:02 Lucas-C