Specifying a sub/peer dependency's version without explicitly requiring it in pyproject

[erikdstock]

I have a pyproject which specifies a need for package A, and required by A is another package B at version 0.1. Now i have a security alert that I need at least version 0.2 for package B. Is there a way to specify that version without making it an explicit dependency of my project (such as package.json's peerDependencies section)?

[neersighted]

There is no equivalent to peerDependencies in Python packaging -- if you care about the version, it is now a top-level dependency. You could implement this as an optional group that you never install explicitly, but that won't work when you use external tools/build sdists and bdists of your package -- that would only work for poetry install.

While technically Poetry could add this as a first-class feature (rather than the groups trick), I don't think there's a ton of benefit as long as other tooling doesn't understand it.

If you want to keep 'peer' versions apart from 'real' deps, put them in a non-optional group so they're in one place in your pyproject.toml -- this was one of the intentions of the groups feature!