poetry

Bomly uses this chain when it finds poetry evidence.

How poetry resolves

poetry-detector is lockfile-first. A readable poetry.lock is the preferred source because it is deterministic and carries transitive dependency data. Bomly only falls back to Poetry environment inspection when a lockfile exists but cannot be parsed.

The inspected graph comes from Poetry's project-managed virtualenv after a locked install attempt. Bomly does not inspect an arbitrary ambient Python environment.

Network behavior

✅ The poetry.lock parser is offline and does not execute Poetry.

⚠️ The locked install fallback can download packages from PyPI or configured Poetry sources, but it uses the existing lockfile and must not update project manifests.

Prerequisites

• A committed poetry.lock.
• pyproject.toml for evidence pattern matching.
• For --install-first: poetry on PATH.

--install-first

poetry supports --install-first. When passed, Bomly runs poetry install --no-root --sync before resolving the graph.

⚠️ --install-first can download packages from PyPI and writes to the Poetry-managed virtualenv without changing the lockfile.

bomly scan --install-first

Customizing the install command

Append flags to poetry install --no-root --sync with repeatable --install-arg. Requires --detectors poetry-detector. Bomly records the sanitized command in scan JSON under the manifest's resolution metadata.

# Production-only graph: skip dev dependencies and a specific group
bomly scan --install-first --detectors poetry-detector \
  --install-arg --without --install-arg dev \
  --install-arg --without --install-arg docs

Examples

Fix a direct vulnerability

[tool.poetry.dependencies]
requests = "^2.32.0"

poetry lock --no-update --regenerate. Re-scan.

Pin a transitive vulnerability

Add the transitive dep at the top level so the resolver respects your version:

[tool.poetry.dependencies]
urllib3 = ">=2.2.2"

Re-lock and re-scan.

Source details

Bomly reads registry, Git, URL, and local-directory sources from each poetry.lock package source table. An unrecognized source type stays unknown.

Reachability (experimental)

Experimental. Reachability is opt-in via --analyze. The feature is stable in shape but may evolve; ecosystem coverage is expanding.

For Poetry-managed packages, the analyzer is pyreach at Tier-3 (package). See REACHABILITY.md.

Limitations

• Poetry 1.x and 2.x lockfile formats are both supported.
• Optional extras (requests[socks]) are recorded as a single distribution; extras-specific transitives appear in the lockfile and graph normally.
• Private indexes (Poetry source configuration) require ~/.config/pypoetry/auth.toml set up locally.
• No lockfile, no graph. Bomly refuses to inspect an unprepared Poetry environment when poetry.lock is missing because that can produce stale or unrelated dependencies.