Poetry 2.4 silently drops [tool.poetry.dependencies] source/marker enrichment for packages not listed in [project] dependencies
Poetry 2.4 silently drops [tool.poetry.dependencies] source/marker enrichment for packages not listed in [project] dependencies. A PEP-621 pyproject pinned torch via a custom source in the enrichment block only:
[[tool.poetry.source]]
name = "pytorch_cpu"
url = "https://download.pytorch.org/whl/cpu"
priority = "explicit"
[tool.poetry.dependencies]
torch = [
{version = "==2.10.0+cpu", source = "pytorch_cpu", markers = "platform_system != 'Darwin'"},
{version = "==2.10.0", markers = "platform_system == 'Darwin'"},
]Under Poetry 2.1.4 this locked torch 2.10.0+cpu from the custom index. After relocking with Poetry 2.4.1, the +cpu/source variant vanished with no warning: the lock kept only PyPI torch, poetry export lost the --extra-index-url header, and the export gained multi-GB nvidia-cu* CUDA wheels. Nothing failed at lock time; the regression surfaces later as image bloat / wrong wheels.
Poetry 2.x treats [tool.poetry.dependencies] as enrichment of [project] dependencies when the latter exists: entries for packages absent from project.dependencies are ignored (2.1.4 still honored them; 2.4.1 drops them silently). Fix: declare the bare name in [project] dependencies ("torch",) and keep constraints/source/markers in the enrichment block. poetry lock then restores both variants (2.10.0+cpu from the custom source for non-Darwin, PyPI wheel for Darwin) and poetry export re-emits --extra-index-url https://download.pytorch.org/whl/cpu with no nvidia transitive deps.
Detection tip after any poetry upgrade + relock: grep -c 'name = "torch"' poetry.lock (expect one entry per variant) and diff exported requirements for surprise nvidia-* lines.