Poetry lockfile resolution fails under memory pressure
0 reputation · 27 Dec 2020, 10:10 UTC
The goal is to determine whether Poetry's resolver memory consumption during poetry.lock generation differs between Poetry 1.x and 2.x, and whether the resulting lockfile remains deterministic across Python versions.
Poetry resolves the complete dependency tree before writing poetry.lock, so projects with many transitive dependencies can exhaust available memory on constrained runners. Resolver and installer internals changed between major versions, making failure behavior version-sensitive. Poetry pins exact versions and content hashes, but does not guarantee byte-identical resolution across different Python versions or environment markers.
No patched version or CVE is asserted; treat resolver memory growth as observed behavior rather than a confirmed vulnerability.
- Does peak resident memory during lockfile resolution differ materially between Poetry 1.x and 2.x?
- Can poetry.lock be byte-identical across different Python versions when environment markers change?
poetry