Skip to content

⬆️ Update dependency poetry to v2.4.3 - #855

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/poetry-2.x
Open

⬆️ Update dependency poetry to v2.4.3#855
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/poetry-2.x

Conversation

@renovate

@renovate renovate Bot commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
poetry (changelog) ==2.4.1==2.4.3 age adoption passing confidence

Release Notes

python-poetry/poetry (poetry)

v2.4.3

Compare Source

Fixed
  • Fix an issue where Poetry could not extract sdists on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 (#​11037).

v2.4.2

Compare Source

Fixed
  • Fix an issue where Poetry installs an artifact that is not listed in the lockfile when the package source does not provide a hash for this artifact (#​11030).
  • Fix a path traversal vulnerability when downloading files from a compromised URL and/or package source (#​11029).
  • Fix a path traversal vulnerability in sdist extraction on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 that could allow malicious tarball files to write files outside the target directory (#​11027).

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added dependencies Pull requests that update a dependency file no-stale labels Sep 3, 2026
@renovate renovate Bot changed the title ⬆️ Update dependency poetry to v2.4.2 ⬆️ Update dependency poetry to v2.4.3 Sep 5, 2026
@renovate
renovate Bot force-pushed the renovate/poetry-2.x branch from 796420e to ff8c0fe Compare September 5, 2026 09:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file no-stale

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants