poetry-core drops the `!=` term from `x != "a" and "b"` not in x

[notatallshaw]

Description

I'm working on marker logic and doing a comparison of different libraries, while doing a scan of poetry, I found a couple of bugs.

Constraint.allows_all decides that x != V is implied by W not in x using the wrong containment test. parse_marker then drops the != term and validate returns the wrong result.

>>> from poetry.core.version.markers import parse_marker
>>> m = parse_marker('os_name != "a" and "b" not in os_name')
>>> print(m)
"b" not in os_name
>>> print(m.validate({"os_name": "a"}))
True

Workarounds

Don't use weird marker combinations, this is obscure, but that's because I'm doing a correctness analysis of all marker handling across the Python ecosystem.

Poetry Installation Method

other

Operating System

ubuntu 24.04 / Windows 11 / Anything

Poetry Version

poetry-core 2.4.1

Poetry Configuration

I'm running all my tests via uvx so I think this isn't relevant but here you go:


Installed 41 packages in 362ms
cache-dir = "C:\\Users\\damia\\AppData\\Local\\pypoetry\\Cache"
data-dir = "C:\\Users\\damia\\AppData\\Roaming\\pypoetry"
installer.max-workers = null
installer.no-binary = null
installer.only-binary = null
installer.parallel = true
installer.re-resolve = false
keyring.enabled = true
python.installation-dir = "{data-dir}\\python"  # C:\Users\damia\AppData\Roaming\pypoetry\python
requests.max-retries = 0
solver.lazy-wheel = true
solver.min-release-age = 0
solver.min-release-age-exclude = null
solver.min-release-age-exclude-source = null
system-git-client = false
virtualenvs.create = true
virtualenvs.in-project = null
virtualenvs.options.always-copy = false
virtualenvs.options.no-pip = false
virtualenvs.options.system-site-packages = false
virtualenvs.path = "{cache-dir}\\virtualenvs"  # C:\Users\damia\AppData\Local\pypoetry\Cache\virtualenvs
virtualenvs.prompt = "{project_name}-py{python_version}"
virtualenvs.use-poetry-python = false

Python Sysconfig

sysconfig.log

Paste the output of 'python -m sysconfig', over this line.

Example pyproject.toml

Poetry Runtime Logs

poetry-runtime.log

Paste the output of 'poetry -vvv <command>', over this line.

[notatallshaw]

This might be because src/poetry/core/constraints/generic/constraint.py, in allows_all, for self = != V and other = W not in x it tests self.value not in other.value where soundness needs other.value in self.value.

[hexonal]

Opened a fix for this in poetry-core: python-poetry/poetry-core#955. The root cause is a backwards containment check in Constraint.allows_all() for the != vs not in combination — write-up and regression tests are in the PR. cc @python-poetry/triage