Poetry Dev Dependency Group Scoping

Last updated: December 8, 2025

Context: Endor Labs SCA for Python Poetry projects have the ability to categorize dependencies (and tag them as "Dev" or "Test") to a customer to further tune the noise of findings. This document describes the scoping mechanism under the hood as of Q4' 2025.

This is for the direct dependencies (pyproject.toml):

1. Tool.Poetry.Dependencies → Normal Scope

  • All packages under [tool.poetry.dependencies] should be marked Normal.

  • Exception:

  •  If the dependency is defined with an "extras" , then its scope becomes Optional instead of Normal.

2. Tool.Poetry.DevDependencies → Optional Scope

  • All packages under [tool.poetry.dev-dependencies] should always be marked as Optional.

3. Tool.Poetry.Group → Optional Scope
All dependencies inside any group are marked Optional.For the transitive deps (.lock file)

  1. If package category is  "dev" , "docs" or "test"

  2. or package is marked as optional , then it will be marked as Optional Scope.

  3. Otherwise it will be Normal Scope