TIL: If two developers with the same Poetry version generate two different lock files from the same pyproject.toml, one of them might have a corrupted Poetry cache.
If this is indeed the problem, the following command should fix it.
poetry cache clear --all .One way to get a corrupted cache is, apparently, to run poetry update while a new version of a package you depend on is published, resulting in an incomplete snapshot of its metadata in your cache. Certainly this is not the only way, and once you have corrupted data, it’s unlikely that they’ll get corrected automatically. Cache invalidation is hard.