Flag to use locked versions in published wheel file?

[marverix]

Hello,

yesterday I discovered interesting thing (maybe new for you, maybe not - I couldn't find topics about it). In our company we are developing internal cli which we publish to Nexus. In this CLI we are using tenacity. And yesterday there was a situation that tenacity published bugged version 8.4.0 which they hotfixed after couple hours. During that time I was just writing new CI pipeline for building our stuff. And when testing, I got that error that I didn't saw before. I looked in the pyproject.toml file and in fact I had version range set to ^8.1.0, and locked version 8.2.1. This is why it worked locally. But I realized that lock version has no effect on published wheel file. This is why when I installed our CLI for testing purposes, I was affected, because published wheel file had range >=8.1.0,<9.0.0 instead 8.2.1. So here is the question: Is this designed so? And if yes, is it a good design? Because I can imagine that it may affect other people too. Maybe there should be some flag that will tell Poetry "Please use locked version in the published wheel file instead range in pyproject.toml"? Or it should use range >=8.1.0,<=8.2.1, which would also make sense because this is somehow compromise between range that I originally set, and the locked version that has been last time tested that it's works as inteded.

Br,
Marek

[radoering]

So here is the question: Is this designed so? And if yes, is it a good design?

It is designed that way and that is a good design for libraries at least. It is debatable for applications.

Maybe there should be some flag that will tell Poetry "Please use locked version in the published wheel file instead range in pyproject.toml"?

See #9428 and #7990 where this issue is discussed for Poetry itself.

Or it should use range >=8.1.0,<=8.2.1, which would also make sense because this is somehow compromise between range that I originally set, and the locked version that has been last time tested that it's works as inteded.

If you want to allow another range, you should specify that range in your pyproject.toml.