Version matching does not conform to PEP440 when specifier sets contain pre-release versions

• I am on the latest Poetry version.
• I have searched the issues of this repo and believe that this is not a duplicate.
• If an exception occurs when executing a command, I executed it again in debug mode (-vvv option).

• OS version and name:
• Poetry version: macOS Catalina 10.15.2 (19C57)
• Link of a Gist with the contents of your pyproject.toml file: https://gist.github.com/charmasaur/6188c4c872b47da599e945691570ff31

Issue

Poetry version matching doesn’t seem to conform to PEP440, specifically for specifier sets containing pre-release versions and inequality constraints.

According to https://www.python.org/dev/peps/pep-0440/#exclusive-ordered-comparison: “The exclusive ordered comparison <V MUST NOT allow a pre-release of the specified version unless the specified version is itself a pre-release.”

From the lock file generated from the pyproject.toml file in the gist above, we have:

<snip>
tensorflow-estimator = ">=2.1.0rc0,<2.2.0"
<snip>
[[package]]
category = "main"
description = "TensorFlow Estimator."
name = "tensorflow-estimator"
optional = false
python-versions = "*"
version = "2.2.0rc0"

That is, despite the constraint “<2.2.0” we’re getting the version “2.2.0rc0”.

The issue seems to be https://github.com/python-poetry/poetry/blob/master/poetry/semver/version_range.py#L63, which doesn’t account for pre-release versions.

Incidentally, when trying to hunt down the cause of this issue I also came across https://github.com/python-poetry/poetry/blob/master/poetry/version/specifiers.py#L715, which doesn’t seem to be used but does look to have a similar issue: if any of the specifiers in the set allow prereleases, the entire set is considered to allow prereleases, which will mean that a constraint like “>=2.1.0rc0,<2.2.0” is considered to allow prereleases and will thus erroneously allow “2.2.0rc0”.

[az0uz]

I think the version constrain solver is at fault here:

from poetry.semver import parse_constraint, Version
parse_constraint("~=2.1.0").allows(Version.parse("2.2.0rc0"))

returns True It seems poetry converts parse_constraint("~=2.1.0") to >=2.1.0,<2.2.0, which I guess is wrong because then we have 2.2.0rc0 < 2.2.0 (which is true) parse_constraint("~=2.1.0") should be >=2.1.0, <2.2.0a0

[charmasaur]

Personally I don’t interpret the PEP that way. It also states The comma (",") is equivalent to a logical and operator: a candidate version must match all given version clauses in order to match the specifier as a whole., which to me suggests that the clauses are treated independently before eventually being ANDed. With that in mind, I don’t think the pre-release in one clause affects the interpretation of the other. Also, The exclusive ordered comparison <V MUST NOT allow a pre-release of the specified version unless the specified version is itself a pre-release. seems unambiguous to me: if V is not a pre-release, then <V must not allow pre-releases of that version.