`poetry lock --no-update` still updates dependencies

• I am on the latest Poetry version.
• I have searched the issues of this repo and believe that this is not a duplicate.
• If an exception occurs when executing a command, I executed it again in debug mode (-vvv option).

• OS version and name:
• Poetry version:
• Link of a Gist with the contents of your pyproject.toml file: https://gist.github.com/tobi-lipede-oodle/2954049e777c9b0178209a7fc3a75858

Issue

To recreate, you can run:

pip install requests==2.25.1
poetry lock --no-update

# Updating dependencies
# Resolving dependencies... (39.6s)

I would expect that after running the commands above, I should just see Resolving dependencies... and my lockfile would just have requests 2.25.1. However, what I actually see is that requests gets updated to 2.26.0.

[jeffvswanson]

I, too, have a use case where I have a pip installed virtual environment whose dependencies I don’t want updated when I run a poetry lock --no-update. It’s also misleading to me that poetry would update the dependencies for my lock file when I pass a --no-update flag.

It would be really useful to have a flag for the lock, install, or add commands to look in a currently existing virtual environment and pull out those packages as pinned dependencies rather than updating the dependencies. Something like --use-venv path/to/venv or the already existing --no-update.

Current behavior

I have a constraints specification in my requirements.txt, so I have to do a poetry run pip install -r requirements.txt to check and install against the constraints (Behavior poetry does not support, as far as I know. And I’m not going to add and pin each package individually, that’s what poetry is for.). Then, when I perform a poetry install or poetry add package to add a package not specified in the requirements.txt poetry updates my existing virtual environment dependencies while adding the package. So, poetry must know about the package installed with pip.

❯ poetry install
Updating dependencies
Resolving dependencies... (86.3s)

Writing lock file

Package operations: 45 installs, 22 updates, 0 removals

  • Updating six (1.15.0 -> 1.16.0)

Expected behavior

I have an existing virtual environment that did not start from a poetry install I pass the command:

❯ poetry install --no-update
Resolving dependencies... (72.4s)

Writing lock file

Package operations: 45 installs, 0 updates, 0 removals

  • Installing charset-normalizer (2.0.4)

And I keep my existing virtual environment while letting poetry figure out the dependency resolution within those constraints. That is, poetry treats existing packages as pinned to a specific version, so influxdb = 5.3.1, rather than updating them.

[bibz]

I believe this is a false positive as Poetry does not know about the package installed by pip.

• pip install requests==2.25.1 will install requests in whatever Python environment is currently active. It will not interact with Poetry.
• poetry lock --no-update will actually create the lockfile because you only specified the pyproject.toml.
  • In your case you specified “compatible with 2.25.1 and update-able” with the line `requests = “^2.25.1”.
  • Since the lockfile does not exist, Poetry will resolve the dependency graph and use the latest 2.y.z version of requests.

Replace pip install … with poetry add requests=2.25.1 and Poetry will pin the dependency to the version 2.25.1. (Note that subsequent poetry update will not update that package unless you relax the constraint. You can do so manually with poetry add requests@latest, or by editing pyproject.toml to add the caret character in front of the version: requests = "^2.25.1".)