[reshmifrog]

• The pull request is targeting the dev branch.
• All static analysis checks passed.
• All tests have passed. If this feature is not already covered by the tests, new tests have been added.
• Updated the Contributing page / ReadMe page / CI Workflow files if needed.

---

Problem

Since Poetry 2.0 the default layout declares dependencies in [project].dependencies instead of [tool.poetry.dependencies]. For such projects jf audit --poetry fails with:

failed to build dependency tree: no dependencies were found. Please try to build your project and re-run the audit command

Nothing gets scanned. Reproduced on the latest release, JFrog CLI 2.131.0, with Poetry 2.5.1: poetry new mre && poetry add aiostream && poetry lock && jf audit --poetry.

Tests

• New fixture tests/testdata/projects/package-managers/python/poetry/poetry-pep621-project: the same dependencies as poetry-project (urllib3 <1.24, django <1.11.16, Werkzeug <0.10), declared in [project]. poetry.lock was generated with Poetry 2.5.1 and passes poetry check --lock.
• Unit: TestBuildPoetryDependencyListPep621 (no poetry install, no Xray). Fails without the fix ([]) and passes with it.
• E2E: TestXrayAuditPoetry now also runs PEP 621 variants of the JSON and Simple JSON cases, with the same expectations as poetry-project (≥3 vulnerabilities, ≥1 license).
• Local end-to-end check of jf audit --poetry --licenses against a SaaS instance, with jf built from jfrog-cli master + this fix. The fixtures were installed through an Artifactory PyPI remote, because direct pypi.org access isn't available in my environment, so I couldn't run the TestXrayAuditPoetry harness itself as-is.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization, Workspace
• Review profile: CHILL
• Plan: Enterprise
• Run ID: db293a16-6ae9-44dc-a906-d20fb3ec71ce

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.