GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Fixes #1447

Summary

Hosted and vendored scans now refuse a source = "pypi"-pinned Poetry dependency when Poetry 1.3 wrote the lock, the same way they already refuse 1.4 – 2.2 locks. Before this, a 1.3 project got a rewired lock that poetry install 1.3 can't solve ("version solving failed"). The scan still exited 0, and its advisory said 1.3 installs it.

Root cause

source_constraint_breaks_writer (utils/poetry_lock.rs) judged the writer only by the version in the @generated by Poetry X.Y stamp. Poetry 1.3 writes that sentence without a version, so generated_by_version returned None and the guard never fired. The hosted rewriter, the vendored guard and the vendored → hosted takeover preflight all go through this one function, so a single fix covers all three.

Fix

• New lock_writer_version: it reads the stamped version when there is one. Otherwise it reports 1.3 for lock-version = "2.0", because only 1.3 – 1.8 write that format and 1.4 – 1.8 always stamp their version. This is the same rule pre_1_4_writer already uses for the stale-install advisories, so the two can no longer disagree about an unstamped 2.0 lock. It also still refuses a 1.3 lock whose header was edited away, which is a case /code-review raised.
• The guard range is now 1.3 – 2.2. The refusal text, the advisory ("1.1 – 1.2 and 2.3+ install it"), docs/testing/poetry-compatibility.md and CLI_CONTRACT.md now name the corrected range.
• CI: added a Poetry 1.3.2 leg to the full-tier e2e_vex_build Poetry matrix. The issue points out that the matrix had no 1.3 leg.

Test evidence

The whole poetry:: e2e suite (4 tests) passes on real Poetry 1.3.2 locally:
SOCKET_PATCH_POETRY_BIN=… SOCKET_PATCH_POETRY_E2E_REQUIRED=1 SOCKET_PATCH_POETRY_E2E_VERSION=1.3.2 cargo test -p socket-patch-cli --all-features --test e2e_vex_build -- poetry:: --ignored

Local gate: cargo fmt --all -- --check and cargo clippy --workspace --all-features -- -D warnings are clean. cargo test --workspace --all-features --no-fail-fast passes except 13 tests that fail only because this sandbox runs as root (chmod-0555 / unremovable-file write-failure tests, which root bypasses) or has no network to patches-api (binary_shared_bundled_record_hosted_pin_is_managed). None of them touch the Poetry source-pin path. CI runs them as non-root.

Per-issue checklist

• The #1282 source-pin guard misses Poetry 1.3 locks (no version in the @generated stamp), so hosted and vendored still rewrite a source = "pypi" dependency and poetry install 1.3 fails with a solver error #1447: hosted refusal (redirect_poetry_lock_unsupported), vendored refusal (pypi_poetry_source_constraint), takeover keeps the package vendored, and the advisory/docs no longer claim 1.3 installs it. Covered by the four unit tests above and by the real-Poetry 1.3.2 e2e.

Review notes

/code-review high also suggested merging the two pre_1_4_writer copies (redirect/poetry.rs, vendor/pypi_poetry.rs) into lock_writer_version, and not re-parsing the lock to read its format. I left both out of this PR. They are pre-existing duplication, they now agree with the new helper, and the extra parse happens once per lock per run. The wrappers (npm/, pypi/, gem/) only dispatch to the binary, so they need no change.

🤖 Generated with Claude Code

https://claude.ai/code/session_01G22ffRqhurh7MjZ7GZA2HM

Generated by Claude Code