`poetry self update` selects an older version of `msgpack`

[bollard]

Description

Hi,

With a fresh install of Poetry (using Python 3.13), and then running poetry self update a number of packages are downgraded. One of them is msgpack which later leads to build failures.

If I look closely at poetry self update -vvv I see the constraint as msgpack (>=0.5.2,<2.0.0), yet I then see it selecting msgpack (1.0.7), despite 1.1.2 already being installed.

poetry self update -vvv

PS C:\Users\Name> poetry self update -vvv
Loading configuration file C:\Users\Name\AppData\Roaming\pypoetry\config.toml
Checking keyring availability: Checking if keyring is available
[keyring:keyring.backend] Loading KWallet
[keyring:keyring.backend] Loading SecretService
[keyring:keyring.backend] Loading Windows
[win32ctypes:win32ctypes.core.ctypes] Loaded ctypes backend
[keyring:keyring.backend] Loading chainer
[keyring:keyring.backend] Loading libsecret
[keyring:keyring.backend] Loading macOS
Using keyring backend 'Windows WinVaultKeyring'
Available
Updating Poetry version ...

Checking keyring availability: Available
Creating new session for pypi.org
Source (PyPI): 113 packages found for poetry *
Using version ^2.3.2 for poetry

Updating dependencies
Resolving dependencies...
   1: fact: poetry-instance is 2.3.2
   1: derived: poetry-instance
   1: fact: poetry-instance depends on poetry (^2.3.2)
   1: selecting poetry-instance (2.3.2)
   1: derived: poetry (>=2.3.2,<3.0.0)
Source (PyPI): 1 packages found for poetry >=2.3.2,<3.0.0
   1: fact: poetry (2.3.2) depends on build (>=1.2.1,<2.0.0)
   1: fact: poetry (2.3.2) depends on cachecontrol[filecache] (>=0.14.0,<0.15.0)
   1: fact: poetry (2.3.2) depends on cleo (>=2.1.0,<3.0.0)
   1: fact: poetry (2.3.2) depends on dulwich (>=0.25.0,<2)
   1: fact: poetry (2.3.2) depends on fastjsonschema (>=2.18.0,<3.0.0)
   1: fact: poetry (2.3.2) depends on findpython (>=0.6.2,<0.8.0)
   1: fact: poetry (2.3.2) depends on installer (>=0.7.0,<0.8.0)
   1: fact: poetry (2.3.2) depends on keyring (>=25.1.0,<26.0.0)
   1: fact: poetry (2.3.2) depends on packaging (>=24.2)
   1: fact: poetry (2.3.2) depends on pbs-installer[download,install] (>=2025.6.10)
   1: fact: poetry (2.3.2) depends on pkginfo (>=1.12,<2.0)
   1: fact: poetry (2.3.2) depends on platformdirs (>=3.0.0,<5)
   1: fact: poetry (2.3.2) depends on poetry-core (2.3.1)
   1: fact: poetry (2.3.2) depends on pyproject-hooks (>=1.0.0,<2.0.0)
   1: fact: poetry (2.3.2) depends on requests (>=2.26,<3.0)
   1: fact: poetry (2.3.2) depends on requests-toolbelt (>=1.0.0,<2.0.0)
   1: fact: poetry (2.3.2) depends on shellingham (>=1.5,<2.0)
   1: fact: poetry (2.3.2) depends on tomlkit (>=0.11.4,<1.0.0)
   1: fact: poetry (2.3.2) depends on trove-classifiers (>=2022.5.19)
   1: fact: poetry (2.3.2) depends on virtualenv (>=20.26.6)
   1: fact: poetry (2.3.2) depends on xattr (>=1.0.0,<2.0.0)
   1: selecting poetry (2.3.2)
   1: derived: xattr (>=1.0.0,<2.0.0)
   1: derived: virtualenv (>=20.26.6)
   1: derived: trove-classifiers (>=2022.5.19)
   1: derived: tomlkit (>=0.11.4,<1.0.0)
   1: derived: shellingham (>=1.5,<2.0)
   1: derived: requests-toolbelt (>=1.0.0,<2.0.0)
   1: derived: requests (>=2.26,<3.0)
   1: derived: pyproject-hooks (>=1.0.0,<2.0.0)
   1: derived: poetry-core (==2.3.1)
   1: derived: platformdirs (>=3.0.0,<5)
   1: derived: pkginfo (>=1.12,<2.0)
   1: derived: pbs-installer[download,install] (>=2025.6.10)
   1: derived: packaging (>=24.2)
   1: derived: keyring (>=25.1.0,<26.0.0)
   1: derived: installer (>=0.7.0,<0.8.0)
   1: derived: findpython (>=0.6.2,<0.8.0)
   1: derived: fastjsonschema (>=2.18.0,<3.0.0)
   1: derived: dulwich (>=0.25.0,<2)
   1: derived: cleo (>=2.1.0,<3.0.0)
   1: derived: cachecontrol[filecache] (>=0.14.0,<0.15.0)
   1: derived: build (>=1.2.1,<2.0.0)
   1: fact: virtualenv (20.26.6) depends on distlib (>=0.3.7,<1)
   1: fact: virtualenv (20.26.6) depends on filelock (>=3.12.2,<4)
   1: fact: virtualenv (20.26.6) depends on platformdirs (>=3.9.1,<5)
   1: selecting virtualenv (20.26.6)
   1: derived: platformdirs (>=3.9.1,<5)
   1: derived: filelock (>=3.12.2,<4)
   1: derived: distlib (>=0.3.7,<1)
   1: fact: requests (2.31.0) depends on charset-normalizer (>=2,<4)
   1: fact: requests (2.31.0) depends on idna (>=2.5,<4)
   1: fact: requests (2.31.0) depends on urllib3 (>=1.21.1,<3)
   1: fact: requests (2.31.0) depends on certifi (>=2017.4.17)
   1: selecting requests (2.31.0)
   1: derived: certifi (>=2017.4.17)
   1: derived: urllib3 (>=1.21.1,<3)
   1: derived: idna (>=2.5,<4)
   1: derived: charset-normalizer (>=2,<4)
   1: fact: cleo (2.1.0) depends on crashtest (>=0.4.1,<0.5.0)
   1: fact: cleo (2.1.0) depends on rapidfuzz (>=3.0.0,<4.0.0)
   1: selecting cleo (2.1.0)
   1: derived: rapidfuzz (>=3.0.0,<4.0.0)
   1: derived: crashtest (>=0.4.1,<0.5.0)
   1: fact: requests-toolbelt (1.0.0) depends on requests (>=2.0.1,<3.0.0)
   1: selecting requests-toolbelt (1.0.0)
   1: fact: pbs-installer[download,install] (2026.1.14) depends on pbs-installer (2026.1.14)
   1: fact: pbs-installer[download,install] (2026.1.14) depends on httpx (>=0.27.0,<1)
   1: fact: pbs-installer[download,install] (2026.1.14) depends on zstandard (>=0.21.0)
   1: selecting pbs-installer[download,install] (2026.1.14)
   1: derived: zstandard (>=0.21.0)
   1: derived: httpx (>=0.27.0,<1)
   1: derived: pbs-installer (==2026.1.14)
   1: fact: cachecontrol[filecache] (0.14.0) depends on cachecontrol (0.14.0)
   1: fact: cachecontrol[filecache] (0.14.0) depends on requests (>=2.16.0)
   1: fact: cachecontrol[filecache] (0.14.0) depends on msgpack (>=0.5.2,<2.0.0)
   1: fact: cachecontrol[filecache] (0.14.0) depends on filelock (>=3.8.0)
   1: selecting cachecontrol[filecache] (0.14.0)
   1: derived: filelock (>=3.8.0)
   1: derived: msgpack (>=0.5.2,<2.0.0)
   1: derived: cachecontrol (==0.14.0)
   1: fact: httpx (0.28.1) depends on anyio (*)
   1: fact: httpx (0.28.1) depends on certifi (*)
   1: fact: httpx (0.28.1) depends on httpcore (==1.*)
   1: fact: httpx (0.28.1) depends on idna (*)
   1: selecting httpx (0.28.1)
   1: derived: httpcore (==1.*)
   1: derived: anyio
   1: fact: cachecontrol (0.14.0) depends on requests (>=2.16.0)
   1: fact: cachecontrol (0.14.0) depends on msgpack (>=0.5.2,<2.0.0)
   1: selecting cachecontrol (0.14.0)
   1: fact: httpcore (1.0.7) depends on certifi (*)
   1: fact: httpcore (1.0.7) depends on h11 (>=0.13,<0.15)
   1: selecting httpcore (1.0.7)
   1: derived: h11 (>=0.13,<0.15)
   1: fact: xattr (1.1.0) depends on cffi (>=1.16.0)
   1: selecting xattr (1.1.0)
   1: derived: cffi (>=1.16.0)
   1: fact: keyring (25.6.0) depends on pywin32-ctypes (>=0.2.0)
   1: fact: keyring (25.6.0) depends on SecretStorage (>=3.2)
   1: fact: keyring (25.6.0) depends on jeepney (>=0.4.2)
   1: fact: keyring (25.6.0) depends on jaraco.classes (*)
   1: fact: keyring (25.6.0) depends on jaraco.functools (*)
   1: fact: keyring (25.6.0) depends on jaraco.context (*)
   1: selecting keyring (25.6.0)
   1: derived: jaraco.context
   1: derived: jaraco.functools
   1: derived: jaraco.classes
   1: derived: jeepney (>=0.4.2)
   1: derived: SecretStorage (>=3.2)
   1: derived: pywin32-ctypes (>=0.2.0)
   1: fact: findpython (0.6.2) depends on packaging (>=20)
   1: selecting findpython (0.6.2)
   1: fact: dulwich (0.25.2) depends on urllib3 (>=2.2.2)
   1: selecting dulwich (0.25.2)
   1: derived: urllib3 (>=2.2.2)
   1: fact: build (1.2.2.post1) depends on packaging (>=19.1)
   1: fact: build (1.2.2.post1) depends on pyproject_hooks (*)
   1: fact: build (1.2.2.post1) depends on colorama (*)
   1: selecting build (1.2.2.post1)
   1: derived: colorama
   1: fact: zstandard (0.23.0) depends on cffi (>=1.11)
   1: selecting zstandard (0.23.0)
   1: derived: cffi (>=1.11)
   1: fact: anyio (4.8.0) depends on idna (>=2.8)
   1: fact: anyio (4.8.0) depends on sniffio (>=1.1)
   1: selecting anyio (4.8.0)
   1: derived: sniffio (>=1.1)
   1: derived: idna (>=2.8)
   1: fact: cffi (1.16.0) depends on pycparser (*)
   1: selecting cffi (1.16.0)
   1: derived: pycparser
   1: fact: jaraco-functools (4.1.0) depends on more-itertools (*)
   1: selecting jaraco-functools (4.1.0)
   1: derived: more-itertools
   1: fact: jaraco-classes (3.3.0) depends on more-itertools (*)
   1: selecting jaraco-classes (3.3.0)
   1: fact: secretstorage (3.3.3) depends on cryptography (>=2.0)
   1: fact: secretstorage (3.3.3) depends on jeepney (>=0.6)
   1: selecting secretstorage (3.3.3)
   1: derived: jeepney (>=0.6)
   1: derived: cryptography (>=2.0)
   1: fact: cryptography (41.0.4) depends on cffi (>=1.12)
   1: selecting cryptography (41.0.4)
   1: derived: cffi (>=1.12)
   1: selecting trove-classifiers (2023.10.18)
   1: selecting tomlkit (0.12.1)
   1: selecting shellingham (1.5.3)
   1: selecting pyproject-hooks (1.0.0)
   1: selecting poetry-core (2.3.1)
   1: selecting platformdirs (3.11.0)
   1: selecting pkginfo (1.12.0)
   1: selecting packaging (24.2)
   1: selecting installer (0.7.0)
   1: selecting fastjsonschema (2.18.1)
   1: selecting filelock (3.12.4)
   1: selecting distlib (0.3.7)
   1: selecting certifi (2023.7.22)
   1: selecting urllib3 (2.6.3)
   1: selecting idna (3.4)
   1: selecting charset-normalizer (3.3.0)
   1: selecting rapidfuzz (3.5.2)
   1: selecting crashtest (0.4.1)
   1: selecting pbs-installer (2026.1.14)
   1: selecting msgpack (1.0.7)
   1: selecting h11 (0.14.0)
   1: selecting jaraco-context (6.0.1)
   1: selecting jeepney (0.8.0)
   1: selecting pywin32-ctypes (0.2.2)
   1: selecting colorama (0.4.6)
   1: selecting sniffio (1.3.1)
   1: selecting pycparser (2.21)
   1: selecting more-itertools (10.1.0)
   1: Version solving took 0.117 seconds.
   1: Tried 1 solutions.

Why is an older version of msgpack selected?

Thanks

Workarounds

Installing and updating Poetry under Python 3.12 works fine

Poetry Installation Method

install.python-poetry.org

Operating System

Windows 11

Poetry Version

2.3.2

Poetry Configuration

cache-dir = "C:\\Users\\User\\AppData\\Local\\pypoetry\\Cache"
data-dir = "C:\\Users\\User\\AppData\\Roaming\\pypoetry"
installer.max-workers = null
installer.no-binary = null
installer.only-binary = null
installer.parallel = true
installer.re-resolve = false
keyring.enabled = true
python.installation-dir = "{data-dir}\\python"  # C:\Users\User\AppData\Roaming\pypoetry\python
requests.max-retries = 0
solver.lazy-wheel = true
system-git-client = false
virtualenvs.create = true
virtualenvs.in-project = true
virtualenvs.options.always-copy = false
virtualenvs.options.no-pip = false
virtualenvs.options.system-site-packages = false
virtualenvs.path = "{cache-dir}\\virtualenvs"  # C:\Users\User\AppData\Local\pypoetry\Cache\virtualenvs
virtualenvs.prompt = "{project_name}-py{python_version}"
virtualenvs.use-poetry-python = false

Python Sysconfig

sysconfig.log

Paste the output of 'python -m sysconfig', over this line.

Example pyproject.toml

Poetry Runtime Logs

poetry-runtime.log

PS C:\Users\User> poetry self update
Updating Poetry version ...

Using version ^2.3.2 for poetry

Updating dependencies
Resolving dependencies... (0.1s)

Package operations: 1 install, 32 updates, 0 removals

- Downgrading certifi (2026.1.4 -> 2023.7.22)
- Downgrading h11 (0.16.0 -> 0.14.0)
- Downgrading idna (3.11 -> 3.4)
- Installing sniffio (1.3.1)
- Downgrading anyio (4.12.1 -> 4.8.0)
- Downgrading more-itertools (10.8.0 -> 10.1.0)
- Downgrading charset-normalizer (3.4.4 -> 3.3.0)
- Downgrading httpcore (1.0.9 -> 1.0.7)
- Downgrading jaraco-classes (3.4.0 -> 3.3.0)
- Downgrading jaraco-context (6.1.0 -> 6.0.1)
- Downgrading distlib (0.4.0 -> 0.3.7)
- Downgrading jaraco-functools (4.4.0 -> 4.1.0)
- Downgrading filelock (3.20.3 -> 3.12.4)
- Downgrading msgpack (1.1.2 -> 1.0.7): Failed

PEP517 build of a dependency failed

Backend subprocess exited when trying to invoke get_requires_for_build_wheel

  | Command '['C:\\Users\\User\\AppData\\Local\\Temp\\tmp45krhf63\\.venv\\Scripts\\python.exe', 'D:\\Poetry\\venv\\Lib\\site-packages\\pyproject_hooks\\_in_process\\_in_process.py', 'get_requires_for_build_wheel', 'C:\\Users\\User\\AppData\\Local\\Temp\\tmpn1qqfk5f']' returned non-zero exit status 1.
  |
  | Traceback (most recent call last):
  |   File "D:\Poetry\venv\Lib\site-packages\pyproject_hooks\_in_process\_in_process.py", line 353, in <module>
  |     main()
  |     ~~~~^^
  |   File "D:\Poetry\venv\Lib\site-packages\pyproject_hooks\_in_process\_in_process.py", line 335, in main
  |     json_out['return_val'] = hook(**hook_input['kwargs'])
  |                              ~~~~^^^^^^^^^^^^^^^^^^^^^^^^
  |   File "D:\Poetry\venv\Lib\site-packages\pyproject_hooks\_in_process\_in_process.py", line 112, in get_requires_for_build_wheel
  |     backend = _build_backend()
  |   File "D:\Poetry\venv\Lib\site-packages\pyproject_hooks\_in_process\_in_process.py", line 74, in _build_backend
  |     ep = os.environ['PEP517_BUILD_BACKEND']
  |          ~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^
  |   File "<frozen os>", line 717, in __getitem__
  | KeyError: 'PEP517_BUILD_BACKEND'

Note: This error originates from the build backend, and is likely not a problem with poetry but one of the following issues with msgpack (1.0.7)

- not supporting PEP 517 builds
- not specifying PEP 517 build requirements correctly
- the build requirements are incompatible with your operating system or Python version
- the build requirements are missing system dependencies (eg: compilers, libraries, headers).

You can verify this by running pip wheel --no-cache-dir --use-pep517 "msgpack (==1.0.7)".

- Downgrading packaging (26.0 -> 24.2)
- Downgrading platformdirs (4.5.1 -> 3.11.0)
- Downgrading pyproject-hooks (1.2.0 -> 1.0.0)
- Downgrading pywin32-ctypes (0.2.3 -> 0.2.2)
- Downgrading rapidfuzz (3.14.3 -> 3.5.2)
- Downgrading requests (2.32.5 -> 2.31.0)
- Downgrading zstandard (0.25.0 -> 0.23.0)
Paste the output of 'poetry -vvv <command>', over this line.

[dosubot]

Poetry selects msgpack 1.0.7 during self update because its dependency, cachecontrol[filecache] (>=0.14.0,<0.15.0), requires msgpack (>=0.5.2,<2.0.0), and Poetry's resolver sometimes picks the lowest compatible version rather than the latest—even if a newer version is already installed. This is not a bug in Poetry, but a limitation of the resolver and the way dependencies are declared by cachecontrol[filecache][source].

The build failure happens because msgpack 1.0.7 doesn't fully support PEP 517 builds or Python 3.13, which leads to errors during installation. This is a known issue with older msgpack versions and new Python releases.

Workarounds:

• Use Python 3.12 for Poetry, which avoids the issue.
• After updating, manually upgrade msgpack in Poetry's environment.
• Consider installing Poetry with pipx to isolate its dependencies and avoid these resolver quirks.
• Watch for updates to Poetry, cachecontrol, or msgpack that improve Python 3.13 compatibility.

More context and similar issues are discussed in this thread.

Written by @dosu, approved by abn

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[dimbleby]

Poetry's resolver sometimes picks the lowest compatible version rather than the latest—even if a newer version is already installed.

This is no answer at all, it is just restating the reported behaviour

I expect the user has a lockfile.