Quick Reference · Python dependency management & packaging

poetry cheat sheet2.x

Poetry manages a project through three things: pyproject.toml (your requirements — now standard PEP 621 [project]), poetry.lock (the exact resolved versions), and an isolated virtualenv Poetry creates for you. add, install, sync & update keep them aligned; run executes inside the env. This sheet is Poetry 2.x — where the config moved to Python's standard layout.

project / core add & remove install · lock · sync env · run · python build · publish config · show · plugins gotcha / 1.x→2.x most common

Verified 2026-08-26 against Poetry 2.4.1 (current; installed & run) · every command from poetry help, workflows confirmed by execution — newaddrun, the PEP 621 pyproject.toml it writes, the generated poetry.lock, groups, show --tree & env all run live. Structure follows the official python-poetry.org docs & 2.0/2.1/2.2/2.4 release notes.

The project loop — declare, lock, install, run
YOU DECLARE (PEP 621) poetry lock RESOLVES poetry install BUILDS THE ENV pyproject.toml now the standard [project] table [project] requires-python = ">=3.12" dependencies = [ "httpx (>=0.28,<0.29)", ] [tool.poetry] — packages, sources, extras lock poetry.lock exact versions + hashes — commit it [[package]] name = "httpx" version = "0.28.1" + anyio, certifi, h11,   httpcore, idna … every transitive dep pinned, with locked markers & groups install isolated virtualenv managed by Poetry — not in your project by default ~/.cache/pypoetry/virtualenvs/   pdemo-UsgxfmwR-py3.12/ httpx anyio certifi httpcore h11 idna poetry run / env activate drops you inside it THE EVERYDAY COMMANDS OPERATE ON THIS LOOP poetry add httpx edits pyproject + lock + venv poetry lock re-resolve → poetry.lock poetry install lock (if needed) + populate env poetry run / env activate execute code inside the venv poetry sync additionally REMOVES anything not in the lock — install only adds/updates $ poetry add httpx Resolving dependencies... Package operations: 7 installs - Installing httpx (0.28.1) Writing lock file $ poetry run python -c "import httpx" # runs inside the managed venv pyproject updated, lock written, env populated — one command, all three in sync
Two ways to start — new project, or adopt an existing one
a new project · poetry scaffolds it
poetry new myapp && cd myapp   # src layout
poetry add httpx              # dep -> pyproject+lock+venv
poetry add --group dev pytest   # a dev group
poetry run pytest             # run in the env
poetry build                  # sdist + wheel
# commit pyproject.toml + poetry.lock
an existing project · reproduce it exactly
git clone … && cd repo
poetry install                # build env from lock
poetry install --only main     # runtime deps only
poetry sync                   # exact match: prune extras
poetry env activate           # print activate command
poetry show --tree            # inspect the graph
PART I

Project & Dependencies

pyproject.toml + poetry.lock
01Install Poetrykeep it isolated
02Start a Projectnew / init
03Add Dependenciespoetry add
04Remove & Updateremove / update
05Dependency Groupsorganize deps
06Extras vs Groupstwo different things
07The Files & Layoutwhat's on disk
PART II

Install, Environments & Run

reproduce & execute
08Install & Reproducepoetry install
09Lock & Syncthe source of truth
10Environmentspoetry env
11Run Commandspoetry run
12Manage Pythonpoetry python
PART III

Build, Publish & Config

ship it & tune it
13Inspect Dependenciespoetry show
14Build & Publishship to PyPI
15Versioningpoetry version
16Configurationpoetry config
17Sources & Authprivate indexes
18Plugins & Exportself add
191.x → 2.x & Gotchaswhat changed
Reading the Outputoperation lines

Four things worth seeing once

The 1.x→2.x config shift, how the resolver turns loose specs into an exact lock, install vs sync, and where groups & extras actually go — all drawn from behaviour verified against Poetry 2.4.1.

the 2.x shift: [tool.poetry] → [project]

The change every stale cheat sheet misses. Poetry 2.x reads standard PEP 621 metadata; the old table stays only for Poetry-specific extras.

Poetry 1.x [tool.poetry] name = "app" version = "0.1.0" [tool.poetry.  dependencies] python = "^3.10" httpx = "^0.28" [...dev-dependencies] 2.0 Poetry 2.x [project] name = "app" requires-python = ">=3.10" dependencies = [ "httpx>=0.28,<1" ] [dependency-groups] dev = [ "pytest" ]

pyproject vs poetry.lock

pyproject holds your loose constraints; the lock records the one exact solution everyone reinstalls. Same idea across every modern manager.

pyproject.toml what you accept dependencies: httpx>=0.27 one loose line no transitive deps solved at lock time resolve poetry.lock what everyone installs httpx ==0.28.1 anyio ==4.14.2 certifi ==2026.7.22 h11 ==0.16.0 httpcore ==1.0.9 idna ==3.18

install vs sync

Both make the env satisfy the lock. Only sync also removes packages that the lock no longer contains — the difference that bites.

env has a leftover package not in the lock: httpx anyio stale-pkg poetry install httpx anyio stale-pkg kept poetry sync httpx anyio stale-pkg gone sync = exact match

where groups & extras go

Groups are for your workflow and never reach users. Extras ship with the package so users can opt in. Different tables, different audiences.

groups [dependency-groups] dev = [pytest, ruff] docs = [sphinx] stay on YOUR machine never published --with / --without / --only extras [project.optional-dependencies] fast = [orjson] cli = [click] SHIP with the package pip install pkg[fast] --extras / --all-extras

Worth memorizing

2.x = PEP 621deps live in [project], not [tool.poetry]
commit / ignorecommit poetry.lock & pyproject; git-ignore the venv
add vs installadd/update re-resolve; install/sync apply the lock
install vs syncsync also removes packages not in the lock
groups: -G / --group--dev is gone; use --group dev
groups vs extrasgroups stay local; extras ship to users
--only mainlean runtime install (add --no-root for Docker)
enter the enveval $(poetry env activate) — shell is gone
export is a pluginpoetry self add poetry-plugin-export
in-project venvconfig virtualenvs.in-project true.venv
CI lock guardpoetry check --lock fails on drift
why is X here?poetry show --tree / --why pkg
what's stale?poetry show --outdated
any build backend2.1+ honours [build-system], not just poetry-core
managed Pythonpoetry python install 3.13 (experimental)
secrets via envPOETRY_HTTP_BASIC_* maps to config