poetry-core icon indicating copy to clipboard operation
poetry-core copied to clipboard

Partially handle extra version for versions constraint

Open mkniewallner opened this issue 3 years ago • 2 comments

Resolves: python-poetry/poetry#3186

  • [x] Added tests for changed code.
  • [ ] Updated documentation for changed code.

Poetry seems to assume that all packages follow SemVer specification for versioning. However, some packages do not, as python-poetry/poetry#3186 highlights with anchor-exp.

Per PEP 440 specification, when packages define more than 3 parts for the versioning, using ~= 1.4.5.0 is equivalent to >= 1.4.5.0, == 1.4.5.*.

Poetry doesn't handle that correctly today, since defining ~= 1.4.5.0 means that we accept >= 1.4.5.0, == 1.4.*.*.

This PR is an attempt at solving this case for both ~= and wildcard operator. It is in draft for multiple reasons:

  • It only handles one more level, which is useful for dependencies using a 4-parts versioning, but it still doesn't handle versioning using more than 4 parts (which I don't think is common, but this could still happen in theory).
  • it only handles ~= and wildcard operators, but what about other ones? Per the documentation, ^ is only for SemVer, but this is less clear for ~, though given how it works, it also doesn't seem to be a good fit with something else than SemVer.
  • Finally, since this would be a breaking change in the constraints handling, I'm not sure we want to introduce this change.

Side note: python-poetry/poetry#3186 also highlights the fact that ~= is undocumented in Poetry. Is there a particular reason to not document it, or would a PR documenting it would be accepted?

mkniewallner avatar Jul 01 '22 20:07 mkniewallner

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
0.0% 0.0% Duplication

sonarqubecloud[bot] avatar Jul 01 '22 20:07 sonarqubecloud[bot]

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
0.0% 0.0% Duplication

sonarqubecloud[bot] avatar Aug 22 '22 08:08 sonarqubecloud[bot]