Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

VEX product detection fails on Poetry 2 projects that declare dynamic = ["version"] with the version in [tool.poetry], so scan --vex exits 1 after rewriting poetry.lock

Cerrado
  • ¿Algo no está bien?
#1,527 3 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Ya se ha fusionado un pull request relacionado.

  • #1529 de @mikolalysenko — fusionado

Evaluación

Dificultad
3/5
Tiempo estimado
Medio día
Aptitud para principiantes
25/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Estancado
Stack tecnológico
python, rust
Área
cli

Línea de trabajo

Start in crates/socket-patch-core/src/vex/product.rs, at parse_pyproject and scan_toml_section, to see why name and version must come from one section. Reproduce with the layout in the issue, then run socket-patch vex -O v.json in a directory with no git origin. Done when that command yields pkg:pypi/[email protected] without --product. The test pattern is in crates/socket-patch-cli/tests/in_process_redirect_poetry.rs. Linked PR #1529 is already open against this bug.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

agent:claimed agent:triaged bug bughunt pm:poetry priority:p1

[agent] Found by the scheduled Poetry bug-hunt routine (ledger #311).

Summary

Poetry 2 documents a PEP 621 layout where [project] has name and dynamic = ["version"], and the version is in [tool.poetry] version (see https://python-poetry.org/docs/pyproject/#version). poetry check, poetry version and poetry build all accept it (demo 0.3.0, demo-0.3.0-py3-none-any.whl).

vex/product.rs::parse_pyproject reads name and version from one section only. It tries [project], which has no version, and then [tool.poetry], which has no name. Both return None, so no product is detected:

  • socket-patch vex -O out.json exits 2 with product_undetected ("pyproject.toml was found but has no usable name and version").
  • socket-patch scan --mode hosted --vex out.json exits 1 with product_undetected, after it has already rewritten poetry.lock to the hosted pin. No VEX document is written.

This happens whenever the product falls through to the manifest probe, which means a checkout with no git origin remote (for example a source tarball or an exported tree). A git remote takes priority in detect_product.

This isn't the same as #642. That issue is about a missing [tool.pdm] fallback. Here both sections are read, but their keys are never combined.

Impact

  • Any Poetry 2 project that uses the documented dynamic-version layout gets no VEX unless the user passes --product by hand, and scan --vex turns a successful hosted rewrite into a failed command (exit 1) in CI.
  • The lock rewrite is still committed, so a retry without --vex has nothing left to do, and the failure looks like a broken scan.

Repro (Linux, Poetry 2.0.1 / 2.2.1 / 2.5.1, no git checkout)

A local mock of the patch API serves a hosted patch for pkg:pypi/[email protected] (same routes as crates/socket-patch-cli/tests/in_process_redirect_poetry.rs). Any patched dependency would do.

mkdir demo-proj && cd demo-proj && mkdir demo && touch demo/__init__.py
cat > pyproject.toml <<'EOF'
[project]
name = "demo"
dynamic = ["version"]
requires-python = ">=3.9"
dependencies = ["six==1.16.0"]

[tool.poetry]
version = "0.3.0"

[build-system]
requires = ["poetry-core>=2.0.0"]
build-backend = "poetry.core.masonry.api"
EOF
poetry check          # All set!
poetry version        # demo 0.3.0
poetry lock
socket-patch scan --mode hosted --json --vex out.vex.json
#  exit 1, status "error", error.code "product_undetected"
#  poetry.lock now carries the hosted pin; out.vex.json not written
socket-patch vex -O v.json                               # exit 2, product_undetected
socket-patch vex -O v.json --product pkg:pypi/[email protected] # exit 0 (workaround)

Control: with version = "0.3.0" in [project] (no dynamic, no [tool.poetry]), scan --mode hosted --vex exits 0 and the product is pkg:pypi/[email protected].

Expected vs actual

  • Expected: vex --help documents auto-detection from "pyproject.toml: pkg:pypi/@". For a project Poetry itself builds as demo 0.3.0, the product should be pkg:pypi/[email protected]: [project].name, plus the [tool.poetry].version that Poetry uses when version is listed in [project].dynamic. CLI_CONTRACT.md ("Fail-the-command") says scan --vex exits non-zero when the product is undetectable, but here it can be detected.
  • Actual: product_undetected. vex exits 2, and scan --vex exits 1 after it has written the lock.

OS × version

OS Poetry Result
Linux 2.0.1 fail (2/2)
Linux 2.2.1 fail
Linux 2.5.1 fail (2/2)
Linux 2.5.1, static [project].version (control) pass
macOS / Windows any untested. The code path doesn't depend on the OS (pure TOML text scan).

Poetry 1.x ignores [project], so the layout only applies to Poetry ≥ 2.0.

Suspect code

  • crates/socket-patch-core/src/vex/product.rs:157-165 (parse_pyproject): scan_toml_section(content, "project").or_else(|| scan_toml_section(content, "tool.poetry")) needs both keys from the same section. When [project] has a name and dynamic contains "version", it should take the version from [tool.poetry].
  • crates/socket-patch-core/src/vex/product.rs:368 (scan_toml_section) returns nothing unless both keys are present.

Main 6a06ddd. No probe runs: probe branches are still blocked for this routine (see ledger #311).

Lenguaje dominante
Rust
Estrellas
8
Forks
1
Merge medio
16 h 18 min
PR fusionados (30 d)
587

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de SocketDev/socket-patch

Todos los issues de SocketDev/socket-patch

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.