feat: add exclude-newer to filter packages by publish date#10813
Open
satyamsoni2211 wants to merge 7 commits intopython-poetry:mainfrom
Open
feat: add exclude-newer to filter packages by publish date#10813satyamsoni2211 wants to merge 7 commits intopython-poetry:mainfrom
satyamsoni2211 wants to merge 7 commits intopython-poetry:mainfrom
Conversation
Add exclude-newer configuration option to [tool.poetry] that prevents Poetry from selecting package versions published within a specified duration. This helps avoid recently published packages with unknown vulnerabilities. Features: - Add exclude-newer = "1 week" (or 3 days, 2 months, etc.) to pyproject.toml - Parses human-readable duration strings using pytimeparse library - Filters packages in Provider.search_for() based on upload_time - Propagates exclude_newer through Solver and Installer layers - Excludes versions where ANY file was uploaded within the duration - Packages without upload_time are included (assumed old/safe) Files: - src/poetry/utils/duration.py: Duration parsing utility - src/poetry/poetry.py: Add exclude_newer property - src/poetry/factory.py: Parse exclude-newer config - src/poetry/puzzle/provider.py: Filter packages by upload_time - src/poetry/puzzle/solver.py: Pass exclude_newer to Provider - src/poetry/installation/installer.py: Pass exclude_newer to Solver - src/poetry/console/application.py: Pass exclude_newer to Installer - src/poetry/console/commands/show.py: Pass exclude_newer to Provider - src/poetry/console/commands/installer_command.py: Reset exclude_newer - tests/test_utils/test_duration.py: Unit tests for duration parsing - tests/puzzle/test_provider.py: Integration test for filtering - docs/pyproject.md: Documentation
Reviewer's GuideImplements an Sequence diagram for dependency resolution with exclude_newer filteringsequenceDiagram
actor User
participant Pyproject as PyprojectTOML
participant Factory
participant Poetry
participant Application
participant InstallerCommand as Command
participant Installer
participant Solver
participant Provider
participant Pool
participant DurationUtil
User->>Pyproject: Set exclude-newer = "1 week"
User->>Command: poetry install
Command->>Factory: create_poetry(cwd, with_groups)
Factory->>Pyproject: read [tool.poetry].exclude-newer
Pyproject-->>Factory: "1 week"
Factory->>DurationUtil: parse_duration("1 week")
DurationUtil-->>Factory: cutoff_datetime
Factory->>Poetry: set_exclude_newer(cutoff_datetime)
Factory-->>Command: Poetry instance
Command->>Application: configure_installer_for_command(Command, io)
Application->>Installer: __init__(..., exclude_newer=Poetry.exclude_newer)
Application-->>Command: Installer instance
Command->>Installer: execute
Installer->>Solver: __init__(..., exclude_newer=_exclude_newer)
Solver->>Provider: __init__(..., exclude_newer=exclude_newer)
loop For each dependency
Solver->>Provider: search_for(dependency)
Provider->>Pool: find_packages(dependency)
Pool-->>Provider: list packages
alt exclude_newer is set
Provider->>Provider: _is_package_excluded_by_newer(package)
Note over Provider: Exclude versions where any file<br/>upload_time > cutoff_datetime
end
Provider-->>Solver: filtered packages
end
Solver-->>Installer: resolution result
Installer-->>User: Packages installed without recent versions
Class diagram for exclude_newer configuration propagationclassDiagram
class Poetry {
- datetime _exclude_newer
+ datetime get_exclude_newer()
+ Poetry set_exclude_newer(datetime exclude_newer)
}
class Factory {
+ Poetry create_poetry(str cwd, bool with_groups)
- datetime parse_exclude_newer(str exclude_newer_str)
}
class Installer {
- datetime _exclude_newer
+ Installer(__IO io, __Env env, Poetry poetry, __Pool pool, __Locker locker, __Config config, bool disable_cache, Mapping build_constraints, datetime exclude_newer)
+ void set_exclude_newer(datetime exclude_newer)
}
class Solver {
+ Solver(Package package, __Pool pool, __Repository installed, list locked, __IO io, Collection active_root_extras, datetime exclude_newer)
}
class Provider {
- datetime _exclude_newer
+ Provider(Package package, __Pool pool, __IO io, list locked, Collection active_root_extras, datetime exclude_newer)
+ list search_for(Dependency dependency)
- bool _is_package_excluded_by_newer(Package package)
}
class DurationUtil {
+ datetime parse_duration(str duration_str)
}
class Application {
+ void configure_installer_for_command(InstallerCommand command, __IO io)
}
class InstallerCommand {
+ void reset_poetry()
+ Installer get_installer()
}
Factory --> Poetry : create_poetry
Factory --> DurationUtil : uses
Poetry <.. Application : provides exclude_newer
Application --> Installer : passes exclude_newer
Installer --> Solver : passes exclude_newer
Solver --> Provider : passes exclude_newer
Provider --> DurationUtil : uses datetime timezone
File-Level Changes
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 3 issues, and left some high level feedback:
- In
Provider._is_package_excluded_by_newer,timezoneis used but never imported in that module, so this will raise aNameError; addfrom datetime import timezoneat the module level or import it in the helper. - The
test_search_for_exclude_newertest hardcodes upload timestamps in 2026 while computingexclude_newerfromdatetime.now(), which makes the assertion time-dependent and potentially brittle; consider deriving upload times relative tonowor freezing time in the test. - In
parse_duration, and in_is_package_excluded_by_newer,dateutilimports are done inside functions; moving these to the module level would reduce repeated imports and make dependencies clearer.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- In `Provider._is_package_excluded_by_newer`, `timezone` is used but never imported in that module, so this will raise a `NameError`; add `from datetime import timezone` at the module level or import it in the helper.
- The `test_search_for_exclude_newer` test hardcodes upload timestamps in 2026 while computing `exclude_newer` from `datetime.now()`, which makes the assertion time-dependent and potentially brittle; consider deriving upload times relative to `now` or freezing time in the test.
- In `parse_duration`, and in `_is_package_excluded_by_newer`, `dateutil` imports are done inside functions; moving these to the module level would reduce repeated imports and make dependencies clearer.
## Individual Comments
### Comment 1
<location path="tests/puzzle/test_provider.py" line_range="1074-1083" />
<code_context>
+def test_search_for_exclude_newer(
</code_context>
<issue_to_address>
**issue (testing):** Make the test time-independent by not hard-coding future upload_time values
This test will eventually become flaky because `exclude_newer` is computed from `datetime.now()`, while `upload_time` is hard-coded to fixed calendar dates. Once the real date passes those timestamps, both packages may be older than the cutoff and the assertion will fail. Instead, derive the `upload_time` strings relative to `exclude_newer` (e.g., `exclude_newer + timedelta(hours=1)` for the newer package and `exclude_newer - timedelta(days=10)` for the older one) so the test stays valid over time.
</issue_to_address>
### Comment 2
<location path="tests/puzzle/test_provider.py" line_range="1087-1096" />
<code_context>
+ provider = Provider(provider._package, provider._pool, NullIO(), exclude_newer=exclude_newer)
+
+ # Add packages with different upload times
+ recent_package = Package("foo", "1.0")
+ recent_package.files = [
+ {"file": "foo-1.0-py3-none-any.whl", "hash": "sha256:abc",
+ "upload_time": "2026-03-30T12:00:00Z"} # recent
+ ]
+
+ old_package = Package("foo", "2.0")
+ old_package.files = [
+ {"file": "foo-2.0-py3-none-any.whl", "hash": "sha256:def",
+ "upload_time": "2026-01-01T12:00:00Z"} # old
+ ]
+
+ repository.add_package(recent_package)
+ repository.add_package(old_package)
+
</code_context>
<issue_to_address>
**suggestion (testing):** Add tests for files without upload_time and mixed old/new files to fully exercise the filtering logic
These tests miss several key behaviors of `_is_package_excluded_by_newer`:
1) Packages whose files all lack `upload_time` should still be included. Please add a case where a package only has files without `upload_time` to ensure `search_for()` doesn’t exclude them.
2) Packages with any file newer than the cutoff should be excluded, even if other files are older. Add a test with one old and one recent `upload_time` in the same package to assert this.
3) Add a boundary test where `upload_time` equals the cutoff to document the intended `>` vs `>=` behavior.
These will ensure the filtering logic is fully exercised and aligned with the rules described in the PR.
Suggested implementation:
```python
def test_search_for_exclude_newer(
provider: Provider,
repository: Repository,
dep: Dependency,
repo_package: Package,
) -> None:
"""Test that packages published within exclude_newer are filtered."""
from datetime import datetime, timezone
from dateutil.relativedelta import relativedelta
# Set exclude_newer to 3 days ago
exclude_newer = datetime.now(timezone.utc) - relativedelta(days=3)
provider = Provider(
provider._package,
provider._pool,
NullIO(),
exclude_newer=exclude_newer,
)
# Baseline: the existing repo_package should still be returned.
results = provider.search_for(dep)
assert repo_package in results
# 1) Packages whose files all lack `upload_time` should still be included.
no_upload_time_pkg = Package("foo-no-upload-time", "1.0")
no_upload_time_pkg.files = [
{
"file": "foo_no_upload_time-1.0-py3-none-any.whl",
"hash": "sha256:no-upload",
}
]
repository.add_package(no_upload_time_pkg)
results = provider.search_for(dep)
# Packages without upload_time must not be excluded by the cutoff.
assert no_upload_time_pkg in results
# 2) Packages with any file newer than the cutoff should be excluded,
# even if other files are older.
mixed_pkg = Package("foo-mixed", "1.0")
old_upload_time = (exclude_newer - relativedelta(days=10)).isoformat()
recent_upload_time = (exclude_newer + relativedelta(days=1)).isoformat()
mixed_pkg.files = [
{
"file": "foo_mixed-1.0-old-py3-none-any.whl",
"hash": "sha256:old",
"upload_time": old_upload_time,
},
{
"file": "foo_mixed-1.0-new-py3-none-any.whl",
"hash": "sha256:new",
"upload_time": recent_upload_time,
},
]
repository.add_package(mixed_pkg)
results = provider.search_for(dep)
# Any file newer than the cutoff excludes the whole package.
assert mixed_pkg not in results
# 3) Boundary test where `upload_time` equals the cutoff; this documents
# the intended `>` vs `>=` behavior in `_is_package_excluded_by_newer`.
boundary_pkg = Package("foo-boundary", "1.0")
boundary_pkg.files = [
{
"file": "foo_boundary-1.0-py3-none-any.whl",
"hash": "sha256:boundary",
"upload_time": exclude_newer.isoformat(),
}
]
repository.add_package(boundary_pkg)
results = provider.search_for(dep)
# If `_is_package_excluded_by_newer` uses a strict `>` comparison, the
# boundary package should be included; if it uses `>=`, this assertion
# should be updated to `assert boundary_pkg not in results`.
assert boundary_pkg in results
```
These edits assume the following are already imported and available in this test module as they are used elsewhere:
- `Dependency`
- `Package`
- `Provider`
- `NullIO`
- Fixtures: `dep`, `repo_package`, `provider`, and `repository`
If any of these fixtures or imports are named differently in your codebase, you will need to:
1. Adjust the test function signature to match your existing fixture names.
2. Ensure `Dependency`, `Package`, and `NullIO` are imported at the top of `tests/puzzle/test_provider.py`.
3. Confirm the intended boundary behavior:
- If packages with `upload_time == exclude_newer` should be excluded, change the last assertion to `assert boundary_pkg not in results`.
</issue_to_address>
### Comment 3
<location path="docs/pyproject.md" line_range="760" />
<code_context>
+
+Supported duration formats include: `seconds`, `minutes`, `hours`, `days`, `weeks`, `months`, `years` (e.g., "3 days", "2 weeks", "1 month").
+
+When set, Poetry will not consider any package version where any file was uploaded within the specified duration. If a package version has multiple files (e.g., wheel and source tarball), it will be excluded if **any** file was uploaded within the duration. Packages without upload time information are included by default (assumed to be older).
+
+
</code_context>
<issue_to_address>
**suggestion (typo):** Clarify the parenthetical phrase to make the sentence grammatically complete.
The parenthetical "(assumed to be older)" reads as a fragment. Consider making it a complete clause, e.g. "…are included by default; they are assumed to be older" or "…, and are assumed to be older."
Suggested implementation:
```
Supported duration formats include: `seconds`, `minutes`, `hours`, `days`, `weeks`, `months`, `years` (e.g., "3 days", "2 weeks", "1 month").
When set, Poetry will not consider any package version where any file was uploaded within the specified duration. If a package version has multiple files (e.g., wheel and source tarball), it will be excluded if **any** file was uploaded within the duration. Packages without upload time information are included by default and are assumed to be older.
```
```
Supported duration formats include: `seconds`, `minutes`, `hours`, `days`, `weeks`, `months`, `years` (e.g., "3 days", "2 weeks", "1 month").
When set, Poetry will not consider any package version where any file was uploaded within the specified duration. If a package version has multiple files (e.g., wheel and source tarball), it will be excluded if **any** file was uploaded within the duration. Packages without upload time information are included by default and are assumed to be older.
```
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
+1074
to
+1083
| def test_search_for_exclude_newer( | ||
| provider: Provider, | ||
| repository: Repository, | ||
| ) -> None: | ||
| """Test that packages published within exclude_newer are filtered.""" | ||
| from datetime import datetime, timezone | ||
| from dateutil.relativedelta import relativedelta | ||
|
|
||
| # Set exclude_newer to 3 days ago | ||
| exclude_newer = datetime.now(timezone.utc) - relativedelta(days=3) |
There was a problem hiding this comment.
issue (testing): Make the test time-independent by not hard-coding future upload_time values
This test will eventually become flaky because exclude_newer is computed from datetime.now(), while upload_time is hard-coded to fixed calendar dates. Once the real date passes those timestamps, both packages may be older than the cutoff and the assertion will fail. Instead, derive the upload_time strings relative to exclude_newer (e.g., exclude_newer + timedelta(hours=1) for the newer package and exclude_newer - timedelta(days=10) for the older one) so the test stays valid over time.
tests/puzzle/test_provider.py
Outdated
Comment on lines
+1087
to
+1096
| recent_package = Package("foo", "1.0") | ||
| recent_package.files = [ | ||
| {"file": "foo-1.0-py3-none-any.whl", "hash": "sha256:abc", | ||
| "upload_time": "2026-03-30T12:00:00Z"} # recent | ||
| ] | ||
|
|
||
| old_package = Package("foo", "2.0") | ||
| old_package.files = [ | ||
| {"file": "foo-2.0-py3-none-any.whl", "hash": "sha256:def", | ||
| "upload_time": "2026-01-01T12:00:00Z"} # old |
There was a problem hiding this comment.
suggestion (testing): Add tests for files without upload_time and mixed old/new files to fully exercise the filtering logic
These tests miss several key behaviors of _is_package_excluded_by_newer:
- Packages whose files all lack
upload_timeshould still be included. Please add a case where a package only has files withoutupload_timeto ensuresearch_for()doesn’t exclude them. - Packages with any file newer than the cutoff should be excluded, even if other files are older. Add a test with one old and one recent
upload_timein the same package to assert this. - Add a boundary test where
upload_timeequals the cutoff to document the intended>vs>=behavior.
These will ensure the filtering logic is fully exercised and aligned with the rules described in the PR.
Suggested implementation:
def test_search_for_exclude_newer(
provider: Provider,
repository: Repository,
dep: Dependency,
repo_package: Package,
) -> None:
"""Test that packages published within exclude_newer are filtered."""
from datetime import datetime, timezone
from dateutil.relativedelta import relativedelta
# Set exclude_newer to 3 days ago
exclude_newer = datetime.now(timezone.utc) - relativedelta(days=3)
provider = Provider(
provider._package,
provider._pool,
NullIO(),
exclude_newer=exclude_newer,
)
# Baseline: the existing repo_package should still be returned.
results = provider.search_for(dep)
assert repo_package in results
# 1) Packages whose files all lack `upload_time` should still be included.
no_upload_time_pkg = Package("foo-no-upload-time", "1.0")
no_upload_time_pkg.files = [
{
"file": "foo_no_upload_time-1.0-py3-none-any.whl",
"hash": "sha256:no-upload",
}
]
repository.add_package(no_upload_time_pkg)
results = provider.search_for(dep)
# Packages without upload_time must not be excluded by the cutoff.
assert no_upload_time_pkg in results
# 2) Packages with any file newer than the cutoff should be excluded,
# even if other files are older.
mixed_pkg = Package("foo-mixed", "1.0")
old_upload_time = (exclude_newer - relativedelta(days=10)).isoformat()
recent_upload_time = (exclude_newer + relativedelta(days=1)).isoformat()
mixed_pkg.files = [
{
"file": "foo_mixed-1.0-old-py3-none-any.whl",
"hash": "sha256:old",
"upload_time": old_upload_time,
},
{
"file": "foo_mixed-1.0-new-py3-none-any.whl",
"hash": "sha256:new",
"upload_time": recent_upload_time,
},
]
repository.add_package(mixed_pkg)
results = provider.search_for(dep)
# Any file newer than the cutoff excludes the whole package.
assert mixed_pkg not in results
# 3) Boundary test where `upload_time` equals the cutoff; this documents
# the intended `>` vs `>=` behavior in `_is_package_excluded_by_newer`.
boundary_pkg = Package("foo-boundary", "1.0")
boundary_pkg.files = [
{
"file": "foo_boundary-1.0-py3-none-any.whl",
"hash": "sha256:boundary",
"upload_time": exclude_newer.isoformat(),
}
]
repository.add_package(boundary_pkg)
results = provider.search_for(dep)
# If `_is_package_excluded_by_newer` uses a strict `>` comparison, the
# boundary package should be included; if it uses `>=`, this assertion
# should be updated to `assert boundary_pkg not in results`.
assert boundary_pkg in resultsThese edits assume the following are already imported and available in this test module as they are used elsewhere:
DependencyPackageProviderNullIO- Fixtures:
dep,repo_package,provider, andrepository
If any of these fixtures or imports are named differently in your codebase, you will need to:
- Adjust the test function signature to match your existing fixture names.
- Ensure
Dependency,Package, andNullIOare imported at the top oftests/puzzle/test_provider.py. - Confirm the intended boundary behavior:
- If packages with
upload_time == exclude_newershould be excluded, change the last assertion toassert boundary_pkg not in results.
- If packages with
|
|
||
| Supported duration formats include: `seconds`, `minutes`, `hours`, `days`, `weeks`, `months`, `years` (e.g., "3 days", "2 weeks", "1 month"). | ||
|
|
||
| When set, Poetry will not consider any package version where any file was uploaded within the specified duration. If a package version has multiple files (e.g., wheel and source tarball), it will be excluded if **any** file was uploaded within the duration. Packages without upload time information are included by default (assumed to be older). |
There was a problem hiding this comment.
suggestion (typo): Clarify the parenthetical phrase to make the sentence grammatically complete.
The parenthetical "(assumed to be older)" reads as a fragment. Consider making it a complete clause, e.g. "…are included by default; they are assumed to be older" or "…, and are assumed to be older."
Suggested implementation:
Supported duration formats include: `seconds`, `minutes`, `hours`, `days`, `weeks`, `months`, `years` (e.g., "3 days", "2 weeks", "1 month").
When set, Poetry will not consider any package version where any file was uploaded within the specified duration. If a package version has multiple files (e.g., wheel and source tarball), it will be excluded if **any** file was uploaded within the duration. Packages without upload time information are included by default and are assumed to be older.
Supported duration formats include: `seconds`, `minutes`, `hours`, `days`, `weeks`, `months`, `years` (e.g., "3 days", "2 weeks", "1 month").
When set, Poetry will not consider any package version where any file was uploaded within the specified duration. If a package version has multiple files (e.g., wheel and source tarball), it will be excluded if **any** file was uploaded within the duration. Packages without upload time information are included by default and are assumed to be older.
|
Related Documentation 1 document(s) may need updating based on files changed in this PR: Python Poetry CHANGELOG
|
Add exclude-newer configuration option to [tool.poetry] that prevents Poetry from selecting package versions published within a specified duration. This helps avoid recently published packages with unknown vulnerabilities. Features: - Add exclude-newer = "1 week" (or 3 days, 2 months, etc.) to pyproject.toml - Parses human-readable duration strings using pytimeparse library - Filters packages in Provider.search_for() based on upload_time - Propagates exclude_newer through Solver and Installer layers - Excludes versions where ANY file was uploaded within the duration - Packages without upload_time are included (assumed old/safe) - Added JSON schema validation for exclude-newer property Files: - src/poetry/utils/duration.py: Duration parsing utility - src/poetry/poetry.py: Add exclude_newer property - src/poetry/factory.py: Parse exclude-newer config - src/poetry/puzzle/provider.py: Filter packages by upload_time - src/poetry/puzzle/solver.py: Pass exclude_newer to Provider - src/poetry/installation/installer.py: Pass exclude_newer to Solver - src/poetry/console/application.py: Pass exclude_newer to Installer - src/poetry/console/commands/show.py: Pass exclude_newer to Provider - src/poetry/console/commands/installer_command.py: Reset exclude_newer - src/poetry/json/schemas/poetry.json: Schema validation for exclude-newer - tests/test_utils/test_duration.py: Unit tests for duration parsing - tests/puzzle/test_provider.py: Integration test for filtering - tests/pyproject/test_pyproject_toml.py: Test for exclude-newer config - tests/pyproject/conftest.py: Test fixtures for exclude-newer - tests/fixtures/complete.toml: Updated fixture with exclude-newer - docs/pyproject.md: Documentation
- Add type ignores for untyped imports (pytimeparse,
dateutil.relativedelta,
dateutil.parser) where library stubs are not installed
- Add no-any-return ignores for relativedelta operations where mypy
cannot
infer the return type
- Add assertion to handle None return from get_embed_wheel
- Add return type annotations to test functions missing them
- Add index type ignore for nested dict access in conftest
satyamsoni2211
force-pushed
the
feature/exclude_newer_flag
branch
from
e253e9a to
56c0cc2
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Summary: Add
exclude-newerPackage Filter FeatureBranch:
feature/exclude_newer_flagAuthor: Satyam Soni
Summary
This PR introduces the
exclude-newerconfiguration option to Poetry, allowing users to filter out package versions published within a specified duration. This is particularly useful for avoiding recently published packages with unknown vulnerabilities or for maintaining reproducible builds.Feature:
exclude-newerPackage FilterOverview
Add
exclude-newerto[tool.poetry]inpyproject.tomlto prevent Poetry from selecting package versions published within a specified time window.Usage
Supported duration formats:
seconds,minutes,hours,days,weeks,months,years(e.g., "3 days", "2 weeks", "1 month")Behavior
Files Changed
src/poetry/utils/duration.pysrc/poetry/poetry.pyexclude_newerpropertysrc/poetry/factory.pyexclude-newerconfigsrc/poetry/puzzle/provider.pyupload_timesrc/poetry/puzzle/solver.pyexclude_newerto Providersrc/poetry/installation/installer.pyexclude_newerto Solversrc/poetry/console/application.pyexclude_newerto Installersrc/poetry/console/commands/show.pyexclude_newerto Providersrc/poetry/console/commands/installer_command.pyexclude_newersrc/poetry/json/schemas/poetry.jsondocs/pyproject.mdTests Added
tests/test_utils/test_duration.py- Unit tests for duration parsingtests/puzzle/test_provider.py- Integration tests for filteringtests/pyproject/test_pyproject_toml.py- Config parsing teststests/pyproject/conftest.py- Test fixtures