Add a poetry.lock file so dependencies can be fixed

Since Lektor is geared towards end users, rather than being a library, I think it would be appropriate to commit a poetry.lock file into the repo, so people can install the exact dependencies each version requires.

Leaving the versions open-ended is good when developing a library, as you don’t want to clash with the other versions in the codebase, but Lektor will presumably be installed with pipx and doesn’t need to care about pinning its exact versions.

Personally, I’ve been having issues where I can no longer build my site because Lektor 3.2.2 doesn’t work with the latest Click. If the versions were pinned, it would keep working, as it would install the exactly compatible version of Click.

[yagebu]

I don’t think we’re in disagreement 😉 I’m mostly arguing against adding fixed dependencies in the released versions of Lektor.

I still think it’s preferable for users to also have lockfiles. Only the most trivial projects will Lektor as their only dependency and will be helped by this lockfile in the Lektor repo. Only a complete lockfile with all plugins and other dependencies allows for consistent reproducible and non-failing builds.

[dairiki]

FWIW, I agree that the correct place for a lock file is probably with each Lektor project. (This can be as simple as a requirements.txt committed to git, or it can be managed with, e.g., poetry if you want bells & whistles.)

Lektor falls in a fuzzy gray area between “application” and “library”. Were it not for the plugins, IMO, it would be more “application”, but with the plugins Lektor is acting more as a “library” in concert with other libraries (i.e. the plugins and their dependencies.) (Though, Lektor, with its “automatic” plugin management, tries to hide the fact, the plugins and their dependencies all go into sys.path, along with lektor. They all have to work together.)