Restrictions coming from dependencies not in the main group are not considered

Description

I tried to define a restriction in a private dependency installed only in a dependency group, not the main dependencies, and restrictions imposed on the dependency were not considered for the lockfile generation.

For example, if my package depends on dependencies A and B (B is in a dependency group), but B also depends on A but with some restrictions, these restrictions are not considered.

Workarounds

Just apply same restrictions on my package.

Poetry Installation Method

pipx

Operating System

Anything

Poetry Version

1.8.3

Poetry Configuration

cache-dir = "/home/vscode/.cache/pypoetry"
experimental.system-git-client = false
installer.max-workers = null
installer.modern-installation = true
installer.no-binary = null
installer.parallel = true
keyring.enabled = true
repositories.codeartifact.url = "https://imcreate-128983747618.d.codeartifact.us-east-1.amazonaws.com/pypi/python-packs/simple/"
repositories.https://imcreate-128983747618.d.codeartifact.us-east-1.amazonaws.com/pypi/python-packs/ = {"url": "https://imcreate-128983747618.d.codeartifact.us-east-1.amazonaws.com/pypi/python-packs/simple"}
solver.lazy-wheel = true
virtualenvs.create = true
virtualenvs.in-project = null
virtualenvs.options.always-copy = false
virtualenvs.options.no-pip = false
virtualenvs.options.no-setuptools = false
virtualenvs.options.system-site-packages = false
virtualenvs.path = "{cache-dir}/virtualenvs"  # /home/vscode/.cache/pypoetry/virtualenvs
virtualenvs.prefer-active-python = false
virtualenvs.prompt = "{project_name}-py{python_version}"
warnings.export = true

Python Sysconfig

not-relevant

Example pyproject.toml

[tool.poetry]
name = "vectman-tasks"
version = "0.1.0"
description = ""
authors = ["Francisco Del Roio <francipvb@hotmail.com>"]
readme = "README.md"
packages = [{ include = "backend", from = "src" }]

[tool.poetry.dependencies]
python = "^3.11"
pydantic = "^1.10.7"
py-optional = "^1.0.1"
plans = "^1.4.0"
users = "^1.4.4"
workgroups = "^1.9.1"
properties = "^1.4.6"
pydantic-geojson = "^0.1.0"
shapely = "^2.0.3"
sqlalchemy-extras = "^2.0.5"


[tool.poetry.group.backend.dependencies]
fastapi = "^0.95.1"
fastapi-simple-pagination = "^1.3.0"
pydantic = { extras = ["dotenv"], version = "^1.10.8" }
sqlalchemy = "^2.0.22"
alembic = "^1.10.4"
taskiq = "^0.11.3"
wsproto = "^1.2.0"
httptools = "^0.5.0"
uvicorn = "^0.22.0"
typer = "^0.12.3"
geoalchemy2 = "^0.13.2"
sentry-sdk = "^1.24.0"
psycopg = "^3.1.9"
users = { extras = ["fastapi"], version = "^1.4.4" }
tenants-client = "^1.0a20"
taskiq-redis = "^0.5.6"
python-socketio = "^5.8.0"
uvloop = "^0.17.0"
vectman-notifier = "^1.0.1" # Private package, depends on pydantic 1.10.x, excluding version 1.10.15
py-optional = "^1.1.3"
loguru = "^0.7.2"
httpx = { version = "^0.23.0", extras = ["cli"] }
taskiq-fastapi = "^0.3.1"

[tool.poetry.group.dev.dependencies]
factory-boy = "^3.2.1"
ruff = "^0.2.1"
black = "^23.3.0"
aiosqlite = "^0.19.0"
pytest = "^7.3.1"
anyio = "^3.7.0"
pytest-asyncio = "^0.21.0"
ipython = "^8.14.0"
ipykernel = "^6.23.2"
pyright = "^1.1.317"
aiohttp = "^3.8.5"
websocket-client = "^1.6.2"

[tool.poetry.scripts]
vectman-tasks = "backend.cli:app"

[build-system]
requires = ["poetry-core"]
build-backend = "poetry.core.masonry.api"


[tool.isort]
profile = "black"

[[tool.poetry.source]]
name = "codeartifact"
url = "https://imcreate-128983747618.d.codeartifact.us-east-1.amazonaws.com/pypi/python-packs/simple/"
priority = "primary"


[[tool.poetry.source]]
name = "PyPI"
priority = "primary"


[tool.ruff]
# Enable pycodestyle (`E`) and Pyflakes (`F`) codes by default.
select = [
  "E",
  "F",
  "ARG",
  "RUF",
  "TRY",
  "YTT",
  "PL",
  "ARG",
  "PTH",
  "N",
  "DTZ",
  "INT",
]
ignore = []

# Allow autofix for all enabled rules (when `--fix`) is provided.
fixable = [
  "A",
  "B",
  "C",
  "D",
  "E",
  "F",
  "G",
  "I",
  "N",
  "Q",
  "S",
  "T",
  "W",
  "ANN",
  "ARG",
  "BLE",
  "COM",
  "DJ",
  "DTZ",
  "EM",
  "ERA",
  "EXE",
  "FBT",
  "ICN",
  "INP",
  "ISC",
  "NPY",
  "PD",
  "PGH",
  "PIE",
  "PL",
  "PT",
  "PTH",
  "PYI",
  "RET",
  "RSE",
  "RUF",
  "SIM",
  "SLF",
  "TCH",
  "TID",
  "TRY",
  "UP",
  "YTT",
]
unfixable = []

# Exclude a variety of commonly ignored directories.
exclude = [
  ".bzr",
  ".direnv",
  ".eggs",
  ".git",
  ".git-rewrite",
  ".hg",
  ".mypy_cache",
  ".nox",
  ".pants.d",
  ".pytype",
  ".ruff_cache",
  ".svn",
  ".tox",
  ".venv",
  "__pypackages__",
  "_build",
  "buck-out",
  "build",
  "dist",
  "node_modules",
  "venv",
]
per-file-ignores = {}

# Same as Black.
line-length = 88

# Allow unused variables when underscore-prefixed.
dummy-variable-rgx = "^(_+|(_+[a-zA-Z0-9_]*[a-zA-Z0-9]+?))$"

# Assume Python 3.10.
target-version = "py311"

[tool.ruff.mccabe]
# Unlike Flake8, default to a complexity level of 10.
max-complexity = 10


[tool.pyright]
typeCheckingMode = "standard"
reportMissingTypeStubs = false

Poetry Runtime Logs

# too large, posted at https://pastebin.com/6VsuryAB

Use the provided pyproject.toml reproduction, especially the backend dependency group and the private vectman-notifier dependency, then run lockfile generation with those groups enabled. Trace how restrictions from dependencies in a non-main group are collected and verify that the generated lockfile reflects the pydantic restriction without requiring the root package to repeat it.