poetry-rye-dependency-management

name	poetry-rye-dependency-management
description	Python dependency management with Poetry and Rye -- lockfile-driven workflows, dependency groups, monorepo patterns, and migration paths. Covers pyproject.toml-centric packaging for projects not yet on uv.
version	2.0.0
category	Languages
agents	["python-pro","developer"]
tags	["python","poetry","rye","dependency-management","packaging","pyproject-toml","lockfile"]
model	sonnet
invoked_by	both
user_invocable	true
tools	["Read","Write","Edit","Bash","Glob","Grep"]
globs	**/pyproject.toml
best_practices	["Always commit lockfiles (poetry.lock / requirements.lock) for reproducible builds","Use dependency groups to separate dev, test, and docs dependencies","Pin direct dependencies to compatible ranges; let the solver resolve transitive deps","Run lockfile audits regularly to detect known CVEs in dependencies","Prefer pyproject.toml over setup.py/setup.cfg for all new projects"]
error_handling	graceful
streaming	supported
verified	true
lastVerifiedAt	2026-03-01
source	builtin
trust_score	100
provenance_sha	b5fc5785a892a151

Poetry / Rye Dependency Management Skill

Python dependency management specialist for Poetry and Rye workflows. Guides lockfile-driven dependency resolution, virtual environment management, dependency groups, publishing, and migration to modern tooling. Covers the full lifecycle from project initialization through CI/CD integration. - Initialize new Python projects with Poetry or Rye - Manage dependency groups (main, dev, test, docs, optional extras) - Configure lockfile-driven builds for reproducibility - Set up CI/CD pipelines with cached dependency installation - Migrate between Poetry, Rye, pip, and uv workflows - Configure monorepo dependency management with workspaces - Audit dependencies for security vulnerabilities - Publish packages to PyPI using Poetry or Rye

Overview

Poetry and Rye are Python dependency managers that enforce lockfile-driven, deterministic builds. Both use pyproject.toml as the single configuration file. Poetry is the established standard (since 2018); Rye is a newer Astral tool that bridges to uv. For greenfield projects, consider modern-python skill (uv-native). This skill covers Poetry/Rye for existing codebases and teams already invested in these tools.

When to Use

• When maintaining existing Poetry or Rye projects
• When a team has standardized on Poetry and migration to uv is not planned
• When publishing Python packages to PyPI (Poetry has mature publishing support)
• When managing monorepo Python workspaces
• When auditing or upgrading dependency lockfiles

Iron Laws

1. ALWAYS commit the lockfile (poetry.lock or requirements.lock) -- without it, builds are non-deterministic and CI/CD will resolve different versions than development.
2. NEVER use pip install in a Poetry/Rye-managed project -- it bypasses the resolver and creates ghost dependencies invisible to the lockfile.
3. ALWAYS use poetry add/rye add to add dependencies -- manual pyproject.toml edits without re-locking create stale lockfiles.
4. NEVER pin transitive dependencies manually -- let the solver manage the full dependency graph; pinning transitive deps causes resolver conflicts.
5. ALWAYS separate runtime and development dependencies into groups -- shipping dev/test dependencies in production images wastes space and expands attack surface.

Anti-Patterns

Anti-Pattern	Why It Fails