What are best practices for update dependencies in Python with Poetry? – Python

The Problem:

Develop a reliable and efficient workflow for automatically updating Python dependencies managed by Poetry within a GitHub repository. Assess the feasibility of using an action to execute poetry update as an alternative to dependabot and renovate, considering the limitations and potential issues in this approach.

The Solutions:

Solution 1: Prefer `poetry lock` over `poetry update` in CI/CD

When working with Poetry in a CI/CD environment, it’s advisable to use `poetry lock` instead of `poetry update`. `poetry update` updates both the `poetry.lock` file and installs the updated packages, whereas `poetry lock` solely updates the `poetry.lock` file.

Since installing packages is unnecessary in CI/CD, `poetry lock` is the preferred choice. However, it’s important to note that `poetry` currently lacks a command to upgrade version ranges in `pyproject.toml`. Therefore, it will not automatically update dependencies beyond their specified version ranges.

For more comprehensive dependency updates, consider using `renovate`, which handles both updating `poetry.lock` and upgrading version ranges.

Video Explanation:

The following video, titled "How to use Poetry to Manage Python Dependencies and Publish ...", provides additional insights and in-depth exploration related to the topics discussed in this post.

I show how to use Poetry to manage your Python dependencies and publish python packages. I setup and install modules into a virtual ...