From 5b5081abe40cd5f6196071f8335153ce8a10d5e9 Mon Sep 17 00:00:00 2001 From: Stefan Kraus Date: Sun, 2 Aug 2026 12:19:43 +0200 Subject: [PATCH 1/5] Require a Poetry that understands the metadata Poetry 1.x rejects a pyproject.toml without [tool.poetry], and 2.0 does not know [dependency-groups] - `--with dev` fails there with "Group(s) not found: dev". Signed-off-by: Stefan Kraus --- .github/workflows/main.yml | 2 +- Dockerfile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index eb70fb6..4236000 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -32,7 +32,7 @@ jobs: with: python-version: ${{ matrix.python-version }} - name: Install Poetry - run: pip install poetry + run: pip install "poetry>=2.1" - name: Update poetry.lock run: poetry lock - name: Install dependencies diff --git a/Dockerfile b/Dockerfile index 89c36c4..1b74de3 100644 --- a/Dockerfile +++ b/Dockerfile @@ -23,6 +23,6 @@ COPY pytm ./pytm COPY docs ./docs COPY *.py Makefile entrypoint.sh ./ -RUN pip install poetry \ +RUN pip install "poetry>=2.1" \ && poetry config virtualenvs.create false \ && poetry install From 679d7cec97a9ca1d5d1622c6d9eb9812d699b51d Mon Sep 17 00:00:00 2001 From: Stefan Kraus Date: Sun, 2 Aug 2026 12:12:43 +0200 Subject: [PATCH 2/5] Put all necessary fields in [project] Lets any packaging tool read the metadata, not just Poetry. The lock file is refreshed because the dependencies moved. Signed-off-by: Stefan Kraus --- poetry.lock | 4 ++-- pyproject.toml | 29 ++++++++++++++++------------- 2 files changed, 18 insertions(+), 15 deletions(-) diff --git a/poetry.lock b/poetry.lock index bd64bc2..864a2ca 100644 --- a/poetry.lock +++ b/poetry.lock @@ -633,5 +633,5 @@ typing-extensions = ">=4.12.0" [metadata] lock-version = "2.1" -python-versions = "^3.11" -content-hash = "a92fc2ee52f70f5920846fb92e9afb0b1acce7a4e8e40f2e69294320f0ab54e7" +python-versions = ">=3.11,<3.15" +content-hash = "a6000fab042dfc46fb1a867721f79a67db5334727f360db23953adab04c8d5ac" diff --git a/pyproject.toml b/pyproject.toml index 322d88a..ef62c1c 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,19 +1,13 @@ -[tool.poetry] +[project] name = "pytm" version = "1.4.0" description = "A Pythonic framework for threat modeling" -authors = ["pytm Team "] -license = "MIT License" +authors = [{ name = "pytm Team", email = "please_use_github_issues@nowhere.com" }] +license = "MIT" readme = "README.md" -homepage = "https://github.com/OWASP/pytm" -packages = [{include = "pytm"}] -include = [ - "pytm/images/*.png", - "pytm/threatlib/threats.json", -] +requires-python = ">=3.11,<3.15" classifiers = [ "Programming Language :: Python :: 3", - "License :: OSI Approved :: MIT License", "Operating System :: OS Independent", "Development Status :: 5 - Production/Stable", "Environment :: Console", @@ -21,10 +15,19 @@ classifiers = [ "Topic :: Security", "Natural Language :: English", ] +dependencies = [ + "pydantic>=2.10.0,<3.0.0", +] -[tool.poetry.dependencies] -python = "^3.11" -pydantic = "^2.10.0" +[project.urls] +Homepage = "https://github.com/OWASP/pytm" + +[tool.poetry] +packages = [{include = "pytm"}] +include = [ + "pytm/images/*.png", + "pytm/threatlib/threats.json", +] [tool.poetry.group.dev.dependencies] pytest = ">=8.3.5,<10.0.0" From c7fd50ea36690059a9ed9a74e883f57a699beb4f Mon Sep 17 00:00:00 2001 From: Stefan Kraus Date: Sun, 2 Aug 2026 12:13:22 +0200 Subject: [PATCH 3/5] Make dev deps readable outside Poetry [dependency-groups] is the standard table for these now, so uv and pip --group can install them without Poetry. Signed-off-by: Stefan Kraus --- poetry.lock | 2 +- pyproject.toml | 14 ++++++++------ 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/poetry.lock b/poetry.lock index 864a2ca..28648b7 100644 --- a/poetry.lock +++ b/poetry.lock @@ -634,4 +634,4 @@ typing-extensions = ">=4.12.0" [metadata] lock-version = "2.1" python-versions = ">=3.11,<3.15" -content-hash = "a6000fab042dfc46fb1a867721f79a67db5334727f360db23953adab04c8d5ac" +content-hash = "f4238c8a1f5b27910133f8160430adf18273c52749fbd59c9250c3909fb35111" diff --git a/pyproject.toml b/pyproject.toml index ef62c1c..7a234e9 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -22,6 +22,14 @@ dependencies = [ [project.urls] Homepage = "https://github.com/OWASP/pytm" +[dependency-groups] +dev = [ + "pytest>=8.3.5,<10.0.0", + "black>=25.9,<27.0", + "pdoc3>=0.11.6,<0.12.0", + "ruff>=0.15.11,<0.16.0", +] + [tool.poetry] packages = [{include = "pytm"}] include = [ @@ -29,12 +37,6 @@ include = [ "pytm/threatlib/threats.json", ] -[tool.poetry.group.dev.dependencies] -pytest = ">=8.3.5,<10.0.0" -black = ">=25.9,<27.0" -pdoc3 = "^0.11.6" -ruff = "^0.15.11" - [tool.ruff] target-version = "py311" From 6107299913a2171dd06480f7111abfc1b605b345 Mon Sep 17 00:00:00 2001 From: Stefan Kraus Date: Sun, 2 Aug 2026 12:14:20 +0200 Subject: [PATCH 4/5] Adopt a standard build backend hatchling is the PyPA-maintained build backend; building a wheel no longer needs Poetry installed, though Poetry stays for the workflow. It ships everything under pytm/, so the packages and include lists Poetry needed go away with it. Signed-off-by: Stefan Kraus --- pyproject.toml | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 7a234e9..83aadc0 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -30,13 +30,6 @@ dev = [ "ruff>=0.15.11,<0.16.0", ] -[tool.poetry] -packages = [{include = "pytm"}] -include = [ - "pytm/images/*.png", - "pytm/threatlib/threats.json", -] - [tool.ruff] target-version = "py311" @@ -54,5 +47,8 @@ ignore = [ ] [build-system] -requires = ["poetry-core>=1.0.0"] -build-backend = "poetry.core.masonry.api" +requires = ["hatchling"] +build-backend = "hatchling.build" + +[tool.hatch.build.targets.wheel] +packages = ["pytm"] From 90de30a6de2aae93ad284be68ac5d0fc47aa2a92 Mon Sep 17 00:00:00 2001 From: Stefan Kraus Date: Sun, 2 Aug 2026 12:16:51 +0200 Subject: [PATCH 5/5] Document the install and build commands Installing and building both changed with the metadata, so the contributing guide spells the standard commands out. Signed-off-by: Stefan Kraus --- CONTRIBUTING.md | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 92b50ac..5a137ca 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -36,6 +36,38 @@ To execute the test suite, from the root of the repo run `make test`. To control To regenerate test fixtures for `json.dumps` and report tests add a `print(output)` statement in the test and run `make test 2>/dev/null > tests/output.json` or `make test 2>/dev/null > tests/output.md`. +## Development + +### Environment + +`pyproject.toml` describes the project with standard `[project]` metadata, so any PEP 517 tool +can install pytm together with its development dependencies: + + uv sync --dev + pip install -e . --group dev # pip 25.1 or newer + +Note that the `Makefile` targets drive the tools through Poetry, so reach for `pytest` and the +`pytm` modules directly in an environment installed this way. + +### Dependencies + +Dependency changes go into `pyproject.toml` - runtime ones under `[project.dependencies]`, +tooling under the `dev` group of `[dependency-groups]`. The repo also carries a `poetry.lock` +that the CI workflow regenerates on each run, so refresh it in your PR when you change +dependencies to keep the two in step. + +### Building + +The build backend is [hatchling](https://hatch.pypa.io/latest/), driven entirely by the +`[project]` table, so every frontend produces the same artifacts: + + uv build + python -m build + +### Bumping the version + +The version lives in `[project].version` - edit it there. + ## PyTM-users Before you post to the [PyTM-users list](https://groups.google.com/forum/#!forum/pytm-users), make sure you look for existing solutions.