Poetry update stays inside the version constraints in pyproject.toml and only rewrites poetry.lock. If the fixed release lies outside that constraint, naming the package does nothing. Change the constraint with poetry add, then let Poetry resolve and write the lock file.
What the documentation says
The Poetry documentation describes poetry update as resolving all dependencies, writing exact versions into poetry.lock and installing them. It then states a note that matters here: the update command does not modify pyproject.toml. It updates only the lock file with the latest compatible versions based on the constraints already defined. To change constraints, use the add command.
You can update a few packages by listing them. The docs warn that this will not update dependencies outside the constraints in pyproject.toml. In other words, updating a package whose constraint is tilde 2.3 or exactly 2.3 is a no-op when 2.4 is available. For it to move, the constraint must change, for example to a caret range, and the add command is how to do that.
Decision table
| Situation | Command idea | Edits pyproject.toml? |
|---|---|---|
| Fixed version inside your constraint | poetry update with the package name | No |
| Fixed version outside your constraint | poetry add with a new constraint | Yes |
| Transitive package, parent allows fix | poetry update with the package name | No |
| Transitive package, parent caps it | Upgrade the parent | Maybe |
Steps for a security fix
- Read the advisory for the first fixed version.
- Check your constraint for the package in pyproject.toml.
- If the fix fits, run poetry update with that one package name. If not, run poetry add with a constraint that admits the fix.
- Read the poetry.lock diff. Only the expected packages should change.
- Install from the lock file in a clean environment and run tests.
- Commit pyproject.toml and poetry.lock together.
poetry update somepackage
poetry add "somepackage>=2.0.1,<3"
Locking versus updating
Poetry also separates installing from updating. The docs say poetry install uses the lock file when present, and for exact reproducible installs they recommend poetry sync, which also removes packages that are not in the lock file. Use poetry update when you want the latest versions within the constraints and a refreshed lock file. A related command, poetry lock, rewrites the lock file, and the docs say the update with the lock option and poetry lock with the regenerate option normally produce the same result.
For CI, install from the lock so the tested versions are the shipped ones. If you are unsure whether to commit the lock file in a library, see the guide on whether to commit poetry.lock for applications versus libraries.
Try it yourself
Click through it at your own pace, or open it full screen. Follow one finding to its fixed version and check whether your constraint allows it.
Where Safeguard fits
Safeguard scans dependencies, runs reachability analysis to show which findings your code can actually reach, and can open fix pull requests through autonomous remediation. That last feature is off by default and every category starts on Manual, so a person approves each change. You can try a free scan on a repository first.
Quick check
Does poetry update change pyproject.toml?
No. It only updates poetry.lock within existing constraints. Use poetry add to change a constraint.
What does poetry sync do that install does not?
It also removes packages that are not in the lock file, giving a cleaner reproducible environment.
Sources
Last reviewed: 19 October 2026.
