python-poetry / python-poetry/poetry
`poetry self update` selects an older version of `msgpack`
Open
Nobody has claimed this yet.
kind/bug
status/triage
- Dominant language
- Python
- Stars
- 34.3k
- Forks
- 2.5k
- Avg merge
- 2d 19h
- Merged PRs (30d)
- 30
Description
Description
Hi,
With a fresh install of Poetry (using Python 3.13), and then running poetry self update a number of packages are downgraded. One of them is msgpack which later leads to build failures.
If I look closely at poetry self update -vvv I see the constraint as msgpack (>=0.5.2,<2.0.0), yet I then see it selecting msgpack (1.0.7), despite 1.1.2 already being installed.
poetry self update -vvv
PS C:\Users\Name> poetry self update -vvv
Loading configuration file C:\Users\Name\AppData\Roaming\pypoetry\config.toml
Checking keyring availability: Checking if keyring is available
[keyring:keyring.backend] Loading KWallet
[keyring:keyring.backend] Loading SecretService
[keyring:keyring.backend] Loading Windows
[win32ctypes:win32ctypes.core.ctypes] Loaded ctypes backend
[keyring:keyring.backend] Loading chainer
[keyring:keyring.backend] Loading libsecret
[keyring:keyring.backend] Loading macOS
Using keyring backend 'Windows WinVaultKeyring'
Available
Updating Poetry version ...
Checking keyring availability: Available
Creating new session for pypi.org
Source (PyPI): 113 packages found for poetry *
Using version ^2.3.2 for poetry
Updating dependencies
Resolving dependencies...
1: fact: poetry-instance is 2.3.2
1: derived: poetry-instance
1: fact: poetry-instance depends on poetry (^2.3.2)
1: selecting poetry-instance (2.3.2)
1: derived: poetry (>=2.3.2,<3.0.0)
Source (PyPI): 1 packages found for poetry >=2.3.2,<3.0.0
1: fact: poetry (2.3.2) depends on build (>=1.2.1,<2.0.0)
1: fact: poetry (2.3.2) depends on cachecontrol[filecache] (>=0.14.0,<0.15.0)
1: fact: poetry (2.3.2) depends on cleo (>=2.1.0,<3.0.0)
1: fact: poetry (2.3.2) depends on dulwich (>=0.25.0,<2)
1: fact: poetry (2.3.2) depends on fastjsonschema (>=2.18.0,<3.0.0)
1: fact: poetry (2.3.2) depends on findpython (>=0.6.2,<0.8.0)
1: fact: poetry (2.3.2) depends on installer (>=0.7.0,<0.8.0)
1: fact: poetry (2.3.2) depends on keyring (>=25.1.0,<26.0.0)
1: fact: poetry (2.3.2) depends on packaging (>=24.2)
1: fact: poetry (2.3.2) depends on pbs-installer[download,install] (>=2025.6.10)
1: fact: poetry (2.3.2) depends on pkginfo (>=1.12,<2.0)
1: fact: poetry (2.3.2) depends on platformdirs (>=3.0.0,<5)
1: fact: poetry (2.3.2) depends on poetry-core (2.3.1)
1: fact: poetry (2.3.2) depends on pyproject-hooks (>=1.0.0,<2.0.0)
1: fact: poetry (2.3.2) depends on requests (>=2.26,<3.0)
1: fact: poetry (2.3.2) depends on requests-toolbelt (>=1.0.0,<2.0.0)
1: fact: poetry (2.3.2) depends on shellingham (>=1.5,<2.0)
1: fact: poetry (2.3.2) depends on tomlkit (>=0.11.4,<1.0.0)
1: fact: poetry (2.3.2) depends on trove-classifiers (>=2022.5.19)
1: fact: poetry (2.3.2) depends on virtualenv (>=20.26.6)
1: fact: poetry (2.3.2) depends on xattr (>=1.0.0,<2.0.0)
1: selecting poetry (2.3.2)
1: derived: xattr (>=1.0.0,<2.0.0)
1: derived: virtualenv (>=20.26.6)
1: derived: trove-classifiers (>=2022.5.19)
1: derived: tomlkit (>=0.11.4,<1.0.0)
1: derived: shellingham (>=1.5,<2.0)
1: derived: requests-toolbelt (>=1.0.0,<2.0.0)
1: derived: requests (>=2.26,<3.0)
1: derived: pyproject-hooks (>=1.0.0,<2.0.0)
1: derived: poetry-core (==2.3.1)
1: derived: platformdirs (>=3.0.0,<5)
1: derived: pkginfo (>=1.12,<2.0)
1: derived: pbs-installer[download,install] (>=2025.6.10)
1: derived: packaging (>=24.2)
1: derived: keyring (>=25.1.0,<26.0.0)
1: derived: installer (>=0.7.0,<0.8.0)
1: derived: findpython (>=0.6.2,<0.8.0)
1: derived: fastjsonschema (>=2.18.0,<3.0.0)
1: derived: dulwich (>=0.25.0,<2)
1: derived: cleo (>=2.1.0,<3.0.0)
1: derived: cachecontrol[filecache] (>=0.14.0,<0.15.0)
1: derived: build (>=1.2.1,<2.0.0)
1: fact: virtualenv (20.26.6) depends on distlib (>=0.3.7,<1)
1: fact: virtualenv (20.26.6) depends on filelock (>=3.12.2,<4)
1: fact: virtualenv (20.26.6) depends on platformdirs (>=3.9.1,<5)
1: selecting virtualenv (20.26.6)
1: derived: platformdirs (>=3.9.1,<5)
1: derived: filelock (>=3.12.2,<4)
1: derived: distlib (>=0.3.7,<1)
1: fact: requests (2.31.0) depends on charset-normalizer (>=2,<4)
1: fact: requests (2.31.0) depends on idna (>=2.5,<4)
1: fact: requests (2.31.0) depends on urllib3 (>=1.21.1,<3)
1: fact: requests (2.31.0) depends on certifi (>=2017.4.17)
1: selecting requests (2.31.0)
1: derived: certifi (>=2017.4.17)
1: derived: urllib3 (>=1.21.1,<3)
1: derived: idna (>=2.5,<4)
1: derived: charset-normalizer (>=2,<4)
1: fact: cleo (2.1.0) depends on crashtest (>=0.4.1,<0.5.0)
1: fact: cleo (2.1.0) depends on rapidfuzz (>=3.0.0,<4.0.0)
1: selecting cleo (2.1.0)
1: derived: rapidfuzz (>=3.0.0,<4.0.0)
1: derived: crashtest (>=0.4.1,<0.5.0)
1: fact: requests-toolbelt (1.0.0) depends on requests (>=2.0.1,<3.0.0)
1: selecting requests-toolbelt (1.0.0)
1: fact: pbs-installer[download,install] (2026.1.14) depends on pbs-installer (2026.1.14)
1: fact: pbs-installer[download,install] (2026.1.14) depends on httpx (>=0.27.0,<1)
1: fact: pbs-installer[download,install] (2026.1.14) depends on zstandard (>=0.21.0)
1: selecting pbs-installer[download,install] (2026.1.14)
1: derived: zstandard (>=0.21.0)
1: derived: httpx (>=0.27.0,<1)
1: derived: pbs-installer (==2026.1.14)
1: fact: cachecontrol[filecache] (0.14.0) depends on cachecontrol (0.14.0)
1: fact: cachecontrol[filecache] (0.14.0) depends on requests (>=2.16.0)
1: fact: cachecontrol[filecache] (0.14.0) depends on msgpack (>=0.5.2,<2.0.0)
1: fact: cachecontrol[filecache] (0.14.0) depends on filelock (>=3.8.0)
1: selecting cachecontrol[filecache] (0.14.0)
1: derived: filelock (>=3.8.0)
1: derived: msgpack (>=0.5.2,<2.0.0)
1: derived: cachecontrol (==0.14.0)
1: fact: httpx (0.28.1) depends on anyio (*)
1: fact: httpx (0.28.1) depends on certifi (*)
1: fact: httpx (0.28.1) depends on httpcore (==1.*)
1: fact: httpx (0.28.1) depends on idna (*)
1: selecting httpx (0.28.1)
1: derived: httpcore (==1.*)
1: derived: anyio
1: fact: cachecontrol (0.14.0) depends on requests (>=2.16.0)
1: fact: cachecontrol (0.14.0) depends on msgpack (>=0.5.2,<2.0.0)
1: selecting cachecontrol (0.14.0)
1: fact: httpcore (1.0.7) depends on certifi (*)
1: fact: httpcore (1.0.7) depends on h11 (>=0.13,<0.15)
1: selecting httpcore (1.0.7)
1: derived: h11 (>=0.13,<0.15)
1: fact: xattr (1.1.0) depends on cffi (>=1.16.0)
1: selecting xattr (1.1.0)
1: derived: cffi (>=1.16.0)
1: fact: keyring (25.6.0) depends on pywin32-ctypes (>=0.2.0)
1: fact: keyring (25.6.0) depends on SecretStorage (>=3.2)
1: fact: keyring (25.6.0) depends on jeepney (>=0.4.2)
1: fact: keyring (25.6.0) depends on jaraco.classes (*)
1: fact: keyring (25.6.0) depends on jaraco.functools (*)
1: fact: keyring (25.6.0) depends on jaraco.context (*)
1: selecting keyring (25.6.0)
1: derived: jaraco.context
1: derived: jaraco.functools
1: derived: jaraco.classes
1: derived: jeepney (>=0.4.2)
1: derived: SecretStorage (>=3.2)
1: derived: pywin32-ctypes (>=0.2.0)
1: fact: findpython (0.6.2) depends on packaging (>=20)
1: selecting findpython (0.6.2)
1: fact: dulwich (0.25.2) depends on urllib3 (>=2.2.2)
1: selecting dulwich (0.25.2)
1: derived: urllib3 (>=2.2.2)
1: fact: build (1.2.2.post1) depends on packaging (>=19.1)
1: fact: build (1.2.2.post1) depends on pyproject_hooks (*)
1: fact: build (1.2.2.post1) depends on colorama (*)
1: selecting build (1.2.2.post1)
1: derived: colorama
1: fact: zstandard (0.23.0) depends on cffi (>=1.11)
1: selecting zstandard (0.23.0)
1: derived: cffi (>=1.11)
1: fact: anyio (4.8.0) depends on idna (>=2.8)
1: fact: anyio (4.8.0) depends on sniffio (>=1.1)
1: selecting anyio (4.8.0)
1: derived: sniffio (>=1.1)
1: derived: idna (>=2.8)
1: fact: cffi (1.16.0) depends on pycparser (*)
1: selecting cffi (1.16.0)
1: derived: pycparser
1: fact: jaraco-functools (4.1.0) depends on more-itertools (*)
1: selecting jaraco-functools (4.1.0)
1: derived: more-itertools
1: fact: jaraco-classes (3.3.0) depends on more-itertools (*)
1: selecting jaraco-classes (3.3.0)
1: fact: secretstorage (3.3.3) depends on cryptography (>=2.0)
1: fact: secretstorage (3.3.3) depends on jeepney (>=0.6)
1: selecting secretstorage (3.3.3)
1: derived: jeepney (>=0.6)
1: derived: cryptography (>=2.0)
1: fact: cryptography (41.0.4) depends on cffi (>=1.12)
1: selecting cryptography (41.0.4)
1: derived: cffi (>=1.12)
1: selecting trove-classifiers (2023.10.18)
1: selecting tomlkit (0.12.1)
1: selecting shellingham (1.5.3)
1: selecting pyproject-hooks (1.0.0)
1: selecting poetry-core (2.3.1)
1: selecting platformdirs (3.11.0)
1: selecting pkginfo (1.12.0)
1: selecting packaging (24.2)
1: selecting installer (0.7.0)
1: selecting fastjsonschema (2.18.1)
1: selecting filelock (3.12.4)
1: selecting distlib (0.3.7)
1: selecting certifi (2023.7.22)
1: selecting urllib3 (2.6.3)
1: selecting idna (3.4)
1: selecting charset-normalizer (3.3.0)
1: selecting rapidfuzz (3.5.2)
1: selecting crashtest (0.4.1)
1: selecting pbs-installer (2026.1.14)
1: selecting msgpack (1.0.7)
1: selecting h11 (0.14.0)
1: selecting jaraco-context (6.0.1)
1: selecting jeepney (0.8.0)
1: selecting pywin32-ctypes (0.2.2)
1: selecting colorama (0.4.6)
1: selecting sniffio (1.3.1)
1: selecting pycparser (2.21)
1: selecting more-itertools (10.1.0)
1: Version solving took 0.117 seconds.
1: Tried 1 solutions.
Why is an older version of msgpack selected?
Thanks
Workarounds
Installing and updating Poetry under Python 3.12 works fine
Poetry Installation Method
install.python-poetry.org
Operating System
Windows 11
Poetry Version
2.3.2
Poetry Configuration
cache-dir = "C:\\Users\\User\\AppData\\Local\\pypoetry\\Cache"
data-dir = "C:\\Users\\User\\AppData\\Roaming\\pypoetry"
installer.max-workers = null
installer.no-binary = null
installer.only-binary = null
installer.parallel = true
installer.re-resolve = false
keyring.enabled = true
python.installation-dir = "{data-dir}\\python" # C:\Users\User\AppData\Roaming\pypoetry\python
requests.max-retries = 0
solver.lazy-wheel = true
system-git-client = false
virtualenvs.create = true
virtualenvs.in-project = true
virtualenvs.options.always-copy = false
virtualenvs.options.no-pip = false
virtualenvs.options.system-site-packages = false
virtualenvs.path = "{cache-dir}\\virtualenvs" # C:\Users\User\AppData\Local\pypoetry\Cache\virtualenvs
virtualenvs.prompt = "{project_name}-py{python_version}"
virtualenvs.use-poetry-python = false
Python Sysconfig
sysconfig.log
Paste the output of 'python -m sysconfig', over this line.
Example pyproject.toml
Poetry Runtime Logs
poetry-runtime.log
PS C:\Users\User> poetry self update
Updating Poetry version ...
Using version ^2.3.2 for poetry
Updating dependencies
Resolving dependencies... (0.1s)
Package operations: 1 install, 32 updates, 0 removals
- Downgrading certifi (2026.1.4 -> 2023.7.22)
- Downgrading h11 (0.16.0 -> 0.14.0)
- Downgrading idna (3.11 -> 3.4)
- Installing sniffio (1.3.1)
- Downgrading anyio (4.12.1 -> 4.8.0)
- Downgrading more-itertools (10.8.0 -> 10.1.0)
- Downgrading charset-normalizer (3.4.4 -> 3.3.0)
- Downgrading httpcore (1.0.9 -> 1.0.7)
- Downgrading jaraco-classes (3.4.0 -> 3.3.0)
- Downgrading jaraco-context (6.1.0 -> 6.0.1)
- Downgrading distlib (0.4.0 -> 0.3.7)
- Downgrading jaraco-functools (4.4.0 -> 4.1.0)
- Downgrading filelock (3.20.3 -> 3.12.4)
- Downgrading msgpack (1.1.2 -> 1.0.7): Failed
PEP517 build of a dependency failed
Backend subprocess exited when trying to invoke get_requires_for_build_wheel
| Command '['C:\\Users\\User\\AppData\\Local\\Temp\\tmp45krhf63\\.venv\\Scripts\\python.exe', 'D:\\Poetry\\venv\\Lib\\site-packages\\pyproject_hooks\\_in_process\\_in_process.py', 'get_requires_for_build_wheel', 'C:\\Users\\User\\AppData\\Local\\Temp\\tmpn1qqfk5f']' returned non-zero exit status 1.
|
| Traceback (most recent call last):
| File "D:\Poetry\venv\Lib\site-packages\pyproject_hooks\_in_process\_in_process.py", line 353, in <module>
| main()
| ~~~~^^
| File "D:\Poetry\venv\Lib\site-packages\pyproject_hooks\_in_process\_in_process.py", line 335, in main
| json_out['return_val'] = hook(**hook_input['kwargs'])
| ~~~~^^^^^^^^^^^^^^^^^^^^^^^^
| File "D:\Poetry\venv\Lib\site-packages\pyproject_hooks\_in_process\_in_process.py", line 112, in get_requires_for_build_wheel
| backend = _build_backend()
| File "D:\Poetry\venv\Lib\site-packages\pyproject_hooks\_in_process\_in_process.py", line 74, in _build_backend
| ep = os.environ['PEP517_BUILD_BACKEND']
| ~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^
| File "<frozen os>", line 717, in __getitem__
| KeyError: 'PEP517_BUILD_BACKEND'
Note: This error originates from the build backend, and is likely not a problem with poetry but one of the following issues with msgpack (1.0.7)
- not supporting PEP 517 builds
- not specifying PEP 517 build requirements correctly
- the build requirements are incompatible with your operating system or Python version
- the build requirements are missing system dependencies (eg: compilers, libraries, headers).
You can verify this by running pip wheel --no-cache-dir --use-pep517 "msgpack (==1.0.7)".
- Downgrading packaging (26.0 -> 24.2)
- Downgrading platformdirs (4.5.1 -> 3.11.0)
- Downgrading pyproject-hooks (1.2.0 -> 1.0.0)
- Downgrading pywin32-ctypes (0.2.3 -> 0.2.2)
- Downgrading rapidfuzz (3.14.3 -> 3.5.2)
- Downgrading requests (2.32.5 -> 2.31.0)
- Downgrading zstandard (0.25.0 -> 0.23.0)
Paste the output of 'poetry -vvv <command>', over this line.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing poetry self update -vvv under Python 3.13 and compare it with the reported Python 3.12 workaround. Trace the dependency resolution for cachecontrol's msgpack (>=0.5.2,<2.0.0) constraint. Done means the resolver no longer selects an older installed-compatible version unexpectedly, with a regression test covering the case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 42/100