poetry-plugin-lock-filter
A Poetry 2.x plugin and standalone CLI for creating marker-specific lock files.
Poetry writes a universal poetry.lock that contains every marker branch. Installation evaluates those markers at runtime, but the lock file itself remains broad. This project post-processes a Poetry lock file and keeps only packages whose markers match a selected target environment.
Why
Given dependencies such as:
[tool.poetry.dependencies]
linux-only = { version = "1.0", markers = "sys_platform == 'linux'" }
windows-only = { version = "2.0", markers = "sys_platform == 'win32'" }
Poetry 2.4.1 writes both packages to poetry.lock, even when only one branch is active on the current machine.
poetry install selects the correct packages, but tools that read poetry.lock directly often see both branches. This plugin produces a clean, target-specific lock file without changing the original.
Features
- Poetry plugin command:
poetry filter-lock - Standalone command:
poetry-lock-filter - Presets for common target environments
- Repeated
--env KEY=VALUEoverrides - Main-group filtering by default
- Optional-package exclusion by default
- Dependency pruning so retained packages only reference retained dependencies
- JSON report output
- Original
poetry.lockis preserved by default
Installation
Install as a Poetry plugin:
poetry self add git+https://github.com/RealDioBrando/poetry-plugin-lock-filter.git
Or install it as a normal Python package:
pip install git+https://github.com/RealDioBrando/poetry-plugin-lock-filter.git
Poetry plugin usage
Run inside a Poetry project:
poetry filter-lock
This reads the project’s poetry.lock and writes:
poetry.target.lock
The default target environment is:
Linux
aarch64
CPython 3.11
Standalone usage
poetry-lock-filter \
--project /path/to/project \
--output poetry.target.lock \
--preset linux-aarch64-cp311
If --project is omitted, the command uses the current directory.
Target presets
currentlinux-aarch64-cp311linux-x86_64-cp311windows-x86_64-cp311
Override individual environment markers:
poetry filter-lock \
--preset linux-aarch64-cp311 \
--env python_version=3.11 \
--env platform_machine=aarch64
Use --preset current to filter for the machine running the command.
Options
--output PATH Output lock file; default poetry.target.lock
--preset NAME Target environment preset
--env KEY=VALUE Override a marker environment value; repeatable
--group NAME Dependency group to retain; default main
--include-optional Keep optional packages
--report PATH Write a JSON filtering report
--no-check Do not require a fresh lock file
The standalone command also supports:
--project PATH Poetry project directory
--lock PATH Explicit lock file path
Example report
{
"status": "success",
"input": "poetry.lock",
"output": "poetry.target.lock",
"group": "main",
"target_environment": {
"python_version": "3.11",
"sys_platform": "linux",
"platform_machine": "aarch64"
},
"included_packages": ["linux-only"],
"excluded_packages": [
{
"package": "windows-only",
"reason": "marker",
"marker": "sys_platform == \"win32\""
}
]
}
Dependency pruning
The filter also removes dependency references from retained packages when the referenced package was excluded.
For example, if linux-only depends on linux-helper, and both match the target environment, both are retained. If linux-only has a Windows-only dependency, that dependency edge is removed from the filtered lock.
Compatibility
- Python 3.11 or newer
- Poetry 2.1 or newer
- Poetry lock format 2.1 or newer
Development
python -m venv .venv
.venv/bin/python -m pip install -e .[dev]
.venv/bin/python -m unittest discover -s tests -v
License
MIT
Related projects
- poetry-plugin-export exports a Poetry lock file to requirements formats, but does not create a marker-filtered lock file.
- poetry-lock-package turns a lock file into a pinned package, but does not filter packages by environment markers.
- ofiuco provides Bazel rules for cross-platform Poetry lock files, but is not a Poetry plugin or standalone marker filter.
Publishing
Releases are published automatically by GitHub Actions when a GitHub release is published.
The workflow uses PyPI trusted publishing and does not store a PyPI token in GitHub.
Before the first automated release, add this repository as a trusted publisher on PyPI:
Owner: RealDioBrando
Repository: poetry-plugin-lock-filter
Workflow: publish.yml
Environment: pypi
Metadata
Release files for poetry-plugin-lock-filter 0.1.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| poetry_plugin_lock_filter-0.1.1.tar.gz | 12.7 kB | With provenance | Details for poetry_plugin_lock_filter-0.1.1.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| poetry_plugin_lock_filter-0.1.1-py3-none-any.whl | Python 3 | none | any | Details for poetry_plugin_lock_filter-0.1.1-py3-none-any.whl |
Total release size: 23.9 kB
Release files / poetry_plugin_lock_filter-0.1.1.tar.gz
| Download URL | poetry_plugin_lock_filter-0.1.1.tar.gz |
|---|---|
| Size | 12.7 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
faf7f461fc1613cb86d2875f60213d55bc7248375670739f6f1e9e350be67fe4
|
|
BLAKE2b-256 checksum How to use checksums |
f4f60e38da3f204f49c130726c4f1597fb662328440b2a727d89455da62a1cfb
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 26, 2026.
Transparency logRelease files / poetry_plugin_lock_filter-0.1.1-py3-none-any.whl
| Download URL | poetry_plugin_lock_filter-0.1.1-py3-none-any.whl |
|---|---|
| Size | 11.3 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
216eea0aa66b995c2b8ffb37434288f8eff4dba728038de95c92e8f6a52d303d
|
|
BLAKE2b-256 checksum How to use checksums |
4a7c7ca430eb334fed83a0743f91d187ab70366f70a6d125a4016198baf37138
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 26, 2026.
Transparency logSecurity for poetry-plugin-lock-filter 0.1.1
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for poetry_plugin_lock_filter-0.1.1.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 26, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.