unrelated package.source vanishes on poetry update --lock (1.0.0b8)

[jstriebel]

• I am on the latest Poetry version.

• I have searched the issues of this repo and believe that this is not a duplicate.

• If an exception occurs when executing a command, I executed it again in debug mode (-vvv option).

• OS version and name: debian buster

• Poetry version: 1.0.0b8

• pyproject.toml is given below

Issue

Thanks for the great work on poetry, it serves us very well in most cases.
Currently we are experiencing a bug when using poetry update --lock in combination with a custom package source.
We resolve the networkit package via our own package registry. When updating a single other package (wkcuber in the following example) via poetry update --lock wkcuber, the definition of networkit in the lockfile changes.
Specifically, the package.source part vanishes, but some metadata is added.

Initially I thought this was the same as #1602, but #1635 did not fix this.
Related to python-poetry/poetry-plugin-export#136, might be related to #1612, does not seem like a duplicate though.

I added a small reproducible example with the respective steps, tested with poetry version 1.0.0b4, 1.0.0b7 and 1.0.0b8:

1. Setup

pyproject.toml:

[tool.poetry]
name = "test"
version = "0.1.0"
description = "test"
authors = []
exclude = [
  "voxelytics/align/data/**/*",
  "voxelytics/connect/test/data/**/*",
]

[tool.poetry.dependencies]
python = "^3.6"
networkit = {version = "5.0.0", source = "scm"}
wkcuber = "0.2.37"

[[tool.poetry.source]]
name = "scm"
url = "https://pypi.scm.io/simple"

[build-system]
requires = ["poetry>=0.12"]
build-backend = "poetry.masonry.api"

2. Initial locking

poetry lock results in the following poetry.lock:

…

[[package]]
category = "main"
description = "NetworKit is a toolbox for high-performance network analysis"
name = "networkit"
optional = false
python-versions = "*"
version = "5.0"

[package.dependencies]
…

[package.source]
reference = "scm"
url = "https://pypi.scm.io/simple"

[[package]]
…

[metadata]
content-hash = "bd910ef453f80858288113c0f8ccbca1c6a80044b45cf96dc0c6c69d10105580"
python-versions = "^3.6"

[metadata.files]
…
networkit = []
…

3. Updating single dependency (:bug:)

Then I updated wkcuber in the pyproject.toml: wkcuber = "0.2.37" and ran poetry update --lock wkcuber. Then the package.source part of networkit is missing and some metadata is added for it:

…

[[package]]
category = "main"
description = "NetworKit is a toolbox for high-performance network analysis"
name = "networkit"
optional = false
python-versions = "*"
version = "5.0"

[package.dependencies]
…

[[package]]
…

[metadata]
content-hash = "bd910ef453f80858288113c0f8ccbca1c6a80044b45cf96dc0c6c69d10105580"
python-versions = "^3.6"

[metadata.files]
…
networkit = [
    {file = "networkit-5.0.tar.gz", hash = "sha256:4fd9439a155cc569000ec039e13680804d8cc233c6d602c88cf0f63174b2babd"},
]
…

4. Updating all

Using poetry lock again yields the expected results (only wkcuber is changed in the lockfile), but this possibly updates other packages too.

Additional notes:

We deactived virtualenvs using poetry config virtualenvs.create false.

poetry debug info:

Poetry
Version: 1.0.0b8
Python:  3.6.8

Virtualenv
Python:         3.6.8
Implementation: CPython
Path:           NA

System
Platform: linux
OS:       posix
Python:   /usr

[jstriebel]

This is fixed in poetry 1.0.0b9, thank you very much!

[github-actions]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.