Version selector always selects highest version for unpinned requirements, causes conflicts

[SnoopJ]

• I am on the latest Poetry version.

• I have searched the issues of this repo and believe that this is not a duplicate.

  • I believe this is related to Support lock dependencies with lowest solvable versions #3527 but it is not a duplicate thereof because that ticket is a feature request rather than a bug report

• If an exception occurs when executing a command, I executed it again in debug mode (-vvv option).

• OS version and name: Ubuntu 20.04

• Poetry version: 1.1.14

• Link of a Gist with the contents of your pyproject.toml file: https://gist.github.com/SnoopJeDi/279a6c1186c09162f0235a4f9676ca75

Issue

NOTE: I am submitting this bug on behalf of a user who brought a question about this issue to #python on the Libera IRC network.

When resolving a poetry add command without any requirement (i.e. poetry add somepkg), the version selector will choose the highest available version from the available versions, even if this will cause a conflict with an existing package by effectively excluding earlier versions.

Reproduction

Below is the reproduction of the exact issue reported by the original user. Note that the version of pytest used by the poetry new command is v5.2 because of some hard-coded defaults in this version, but I can also reproduce this bug against ff8ae32 (which does not have this pinned version of pytest in the pyproject.toml created by poetry new) by doing poetry add pytest^5.2 before poetry add pluggy. In both cases, the flaw can be avoided by using a more specific requirement, i.e. poetry add "pluggy<1.0"

$ python3 -V
Python 3.8.10
$ python3 -m pip install poetry==1.1.14
Collecting poetry==1.1.14
...snip...

Successfully installed SecretStorage-3.3.2 cachecontrol-0.12.11 cachy-0.3.0 certifi-2022.6.15 cffi-1.15.1 charset-normalizer-2.1.0 cleo-0.8.1 clikit-0.6.2 crashtest-0
.3.1 cryptography-37.0.4 distlib-0.3.5 filelock-3.7.1 html5lib-1.1 idna-3.3 importlib-metadata-4.12.0 jeepney-0.8.0 keyring-23.7.0 lockfile-0.12.2 msgpack-1.0.4 packaging-20.9 pastel-0.2.1 pexpect-4.8.0 pkginfo-1.8.3 platformdirs-2.5.2 poetry-1.1.14 poetry-core-1.0.8 ptyprocess-0.7.0 pycparser-2.21 pylev-1.4.0 pyparsing-3.0.9 requ
ests-2.28.1 requests-toolbelt-0.9.1 shellingham-1.4.0 six-1.16.0 tomlkit-0.11.1 urllib3-1.26.10 virtualenv-20.15.1 webencodings-0.5.1 zipp-3.8.1
$ poetry new --src bug_repro/ && cd bug_repro/
Created package bug_repro in bug_repro
$ poetry add pluggy
Using version ^1.0.0 for pluggy

Updating dependencies
Resolving dependencies... (0.4s)

  SolverProblemError

  Because no versions of pytest match >5.2,<5.2.1 || >5.2.1,<5.2.2 || >5.2.2,<5.2.3 || >5.2.3,<5.2.4 || >5.2.4,<5.3.0 || >5.3.0,<5.3.1 || >5.3.1,<5.3.2 || >5.3.2,<5.3.3 || >5.3.3,<5.3.4 || >5.3.4,<5.3.5 || >5.3.5,<5.4.0 || >5.4.0,<5.4.1 || >5.4.1,<5.4.2 || >5.4.2,<5.4.3 || >5.4.3,<6.0
   and pytest (5.2.0) depends on pluggy (>=0.12,<1.0), pytest (>=5.2,<5.2.1 || >5.2.1,<5.2.2 || >5.2.2,<5.2.3 || >5.2.3,<5.2.4 || >5.2.4,<5.3.0 || >5.3.0,<5.3.1 || >5.3.1,<5.3.2 || >5.3.2,<5.3.3 || >5.3.3,<5.3.4 || >5.3.4,<5.3.5 || >5.3.5,<5.4.0 || >5.4.0,<5.4.1 || >5.4.1,<5.4.2 || >5.4.2,<5.4.3 || >5.4.3,<6.0) requires pluggy (>=0.12,<1.0).
  And because pytest (5.2.1) depends on pluggy (>=0.12,<1.0)
   and pytest (5.2.2) depends on pluggy (>=0.12,<1.0), pytest (>=5.2,<5.2.3 || >5.2.3,<5.2.4 || >5.2.4,<5.3.0 || >5.3.0,<5.3.1 || >5.3.1,<5.3.2 || >5.3.2,<5.3.3 || >5.3.3,<5.3.4 || >5.3.4,<5.3.5 || >5.3.5,<5.4.0 || >5.4.0,<5.4.1 || >5.4.1,<5.4.2 || >5.4.2,<5.4.3 || >5.4.3,<6.0) requires pluggy (>=0.12,<1.0).
  And because pytest (5.2.3) depends on pluggy (>=0.12,<1.0)
   and pytest (5.2.4) depends on pluggy (>=0.12,<1.0), pytest (>=5.2,<5.3.0 || >5.3.0,<5.3.1 || >5.3.1,<5.3.2 || >5.3.2,<5.3.3 || >5.3.3,<5.3.4 || >5.3.4,<5.3.5 || >5.3.5,<5.4.0 || >5.4.0,<5.4.1 || >5.4.1,<5.4.2 || >5.4.2,<5.4.3 || >5.4.3,<6.0) requires pluggy (>=0.12,<1.0).
  And because pytest (5.3.0) depends on pluggy (>=0.12,<1.0)
   and pytest (5.3.1) depends on pluggy (>=0.12,<1.0), pytest (>=5.2,<5.3.2 || >5.3.2,<5.3.3 || >5.3.3,<5.3.4 || >5.3.4,<5.3.5 || >5.3.5,<5.4.0 || >5.4.0,<5.4.1 || >5.4.1,<5.4.2 || >5.4.2,<5.4.3 || >5.4.3,<6.0) requires pluggy (>=0.12,<1.0).
  And because pytest (5.3.2) depends on pluggy (>=0.12,<1.0)
   and pytest (5.3.3) depends on pluggy (>=0.12,<1.0), pytest (>=5.2,<5.3.4 || >5.3.4,<5.3.5 || >5.3.5,<5.4.0 || >5.4.0,<5.4.1 || >5.4.1,<5.4.2 || >5.4.2,<5.4.3 || >5.4.3,<6.0) requires pluggy (>=0.12,<1.0).
  And because pytest (5.3.4) depends on pluggy (>=0.12,<1.0)
   and pytest (5.3.5) depends on pluggy (>=0.12,<1.0), pytest (>=5.2,<5.4.0 || >5.4.0,<5.4.1 || >5.4.1,<5.4.2 || >5.4.2,<5.4.3 || >5.4.3,<6.0) requires pluggy (>=0.12,<1.0).
  And because pytest (5.4.0) depends on pluggy (>=0.12,<1.0)
   and pytest (5.4.1) depends on pluggy (>=0.12,<1.0), pytest (>=5.2,<5.4.2 || >5.4.2,<5.4.3 || >5.4.3,<6.0) requires pluggy (>=0.12,<1.0).
  And because pytest (5.4.2) depends on pluggy (>=0.12,<1.0)
   and pytest (5.4.3) depends on pluggy (>=0.12,<1.0), pytest (>=5.2,<6.0) requires pluggy (>=0.12,<1.0).
  So, because bug-repro depends on both pluggy (^1.0.0) and pytest (^5.2), version solving failed.

  at ~/3.8venv/lib/python3.8/site-packages/poetry/puzzle/solver.py:241 in _solve
      237│             packages = result.packages
      238│         except OverrideNeeded as e:
      239│             return self.solve_in_compatibility_mode(e.overrides, use_latest=use_latest)
      240│         except SolveFailure as e:
    → 241│             raise SolverProblemError(e)
      242│
      243│         results = dict(
      244│             depth_first_search(
      245│                 PackageNode(self._package, packages), aggregate_package_nodes

[dimbleby]

duplicate #707, #1589, #1963, #2171, #5453

[Secrus]

Closing as duplicate

[dimbleby]

might as well close all but one of the others while you're at it

[github-actions]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.