Skip to content

chore(deps): bump poetry from 2.4.1 to 2.4.3 - #1392

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/poetry-2.4.3
Closed

chore(deps): bump poetry from 2.4.1 to 2.4.3#1392
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/poetry-2.4.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps poetry from 2.4.1 to 2.4.3.

Release notes

Sourced from poetry's releases.

2.4.3

Fixed

  • Fix an issue where Poetry could not extract sdists on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 (#11037).

2.4.2

Fixed

  • Fix an issue where Poetry installs an artifact that is not listed in the lockfile when the package source does not provide a hash for this artifact (#11030).
  • Fix a path traversal vulnerability when downloading files from a compromised URL and/or package source (#11029).
  • Fix a path traversal vulnerability in sdist extraction on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 that could allow malicious tarball files to write files outside the target directory (#11027).
Changelog

Sourced from poetry's changelog.

[2.4.3] - 2026-09-05

Fixed

  • Fix an issue where Poetry could not extract sdists on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 (#11037).

[2.4.2] - 2026-08-29

Fixed

  • Fix an issue where Poetry installs an artifact that is not listed in the lockfile when the package source does not provide a hash for this artifact (#11030).
  • Fix a path traversal vulnerability when downloading files from a compromised URL and/or package source (#11029).
  • Fix a path traversal vulnerability in sdist extraction on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 that could allow malicious tarball files to write files outside the target directory (#11027).
Commits
  • 4d69b9b release: bump version to 2.4.3
  • 4659943 Fix sdist extraction on older Python versions (#11037)
  • 15ce1fc release: bump version to 2.4.2
  • 3dd0f2d perf: avoid unnecessary downloads when the index does not provide hashes
  • c2f9af2 Fail closed when a locked hash cannot be checked
  • 3a194dd fix: reject invalid link filenames when downloading files (#11029)
  • 22173fd fix: refuse to write files outside the target directory during sdist extracti...
  • See full diff in compare view

@dependabot
dependabot Bot requested a review from dlrsp-dev as a code owner September 8, 2026 20:24
@dependabot dependabot Bot added the 📦 dependencies Update of dependencies label Sep 8, 2026
@dependabot dependabot Bot mentioned this pull request Sep 8, 2026
Closed
@dlrsp-actions
dlrsp-actions Bot force-pushed the dependabot/pip/poetry-2.4.3 branch from e5e5c9e to d9b8c3c Compare September 9, 2026 12:37
@dlrsp-actions
dlrsp-actions Bot enabled auto-merge (rebase) September 9, 2026 12:43
@dlrsp-actions
dlrsp-actions Bot force-pushed the dependabot/pip/poetry-2.4.3 branch from d9b8c3c to ca7aae6 Compare September 9, 2026 12:45
@dlrsp-actions
dlrsp-actions Bot force-pushed the dependabot/pip/poetry-2.4.3 branch from ca7aae6 to 6315b2c Compare September 9, 2026 13:02
@dlrsp-actions
dlrsp-actions Bot force-pushed the dependabot/pip/poetry-2.4.3 branch from 6315b2c to 337ef52 Compare September 10, 2026 12:31
@dlrsp-actions
dlrsp-actions Bot force-pushed the dependabot/pip/poetry-2.4.3 branch from 337ef52 to a064cce Compare September 10, 2026 12:40
@dlrsp-actions
dlrsp-actions Bot force-pushed the dependabot/pip/poetry-2.4.3 branch from a064cce to 85af7a7 Compare September 14, 2026 14:36
@dlrsp-actions
dlrsp-actions Bot force-pushed the dependabot/pip/poetry-2.4.3 branch from 85af7a7 to 3ce4854 Compare September 14, 2026 14:44
@dlrsp-actions
dlrsp-actions Bot force-pushed the dependabot/pip/poetry-2.4.3 branch from 3ce4854 to ad918f6 Compare September 15, 2026 13:02
@dlrsp-actions
dlrsp-actions Bot force-pushed the dependabot/pip/poetry-2.4.3 branch from ad918f6 to dabb384 Compare September 15, 2026 13:10
@dlrsp-actions
dlrsp-actions Bot force-pushed the dependabot/pip/poetry-2.4.3 branch from dabb384 to d0a89ba Compare September 15, 2026 13:22
@dlrsp-actions
dlrsp-actions Bot force-pushed the dependabot/pip/poetry-2.4.3 branch from d0a89ba to 44ac87f Compare September 16, 2026 13:00
@dlrsp-actions
dlrsp-actions Bot force-pushed the dependabot/pip/poetry-2.4.3 branch from 44ac87f to 4ee0d2f Compare September 16, 2026 13:11
@dlrsp-actions
dlrsp-actions Bot force-pushed the dependabot/pip/poetry-2.4.3 branch from 4ee0d2f to d686608 Compare September 16, 2026 13:23
@dlrsp-actions
dlrsp-actions Bot force-pushed the dependabot/pip/poetry-2.4.3 branch from 2fa37aa to 5721871 Compare September 19, 2026 12:14
@dependabot
dependabot Bot force-pushed the dependabot/pip/poetry-2.4.3 branch from 5721871 to 7a973d0 Compare September 19, 2026 12:17
@dlrsp-actions
dlrsp-actions Bot force-pushed the dependabot/pip/poetry-2.4.3 branch from 7a973d0 to 3b36516 Compare September 19, 2026 12:24
@dlrsp-actions dlrsp-actions Bot added the needs-human-review Policy gate blocked; human review required label Sep 19, 2026
@dlrsp-actions

dlrsp-actions Bot commented Sep 19, 2026

Copy link
Copy Markdown
Contributor

Policy gate blocked this PR: default-fail: matched catch-all policy

@dlrsp-actions dlrsp-actions Bot removed the needs-human-review Policy gate blocked; human review required label Sep 19, 2026
@dlrsp-actions
dlrsp-actions Bot force-pushed the dependabot/pip/poetry-2.4.3 branch from 3b36516 to 621a009 Compare September 19, 2026 12:35
@dlrsp-actions
dlrsp-actions Bot force-pushed the dependabot/pip/poetry-2.4.3 branch 2 times, most recently from 14f7a3d to f1b99a0 Compare September 20, 2026 12:54
@dlrsp-actions dlrsp-actions Bot added the needs-human-review Policy gate blocked; human review required label Sep 20, 2026
@dlrsp-actions

dlrsp-actions Bot commented Sep 20, 2026

Copy link
Copy Markdown
Contributor

Policy gate blocked this PR: default-fail: matched catch-all policy

@dlrsp-actions dlrsp-actions Bot removed the needs-human-review Policy gate blocked; human review required label Sep 20, 2026
@dlrsp-actions
dlrsp-actions Bot force-pushed the dependabot/pip/poetry-2.4.3 branch from f1b99a0 to f5834cb Compare September 21, 2026 14:43
@dlrsp-actions
dlrsp-actions Bot force-pushed the dependabot/pip/poetry-2.4.3 branch from f5834cb to 4b463d1 Compare September 21, 2026 14:52
@dlrsp-actions
dlrsp-actions Bot force-pushed the dependabot/pip/poetry-2.4.3 branch from 4b463d1 to 4abe855 Compare September 22, 2026 12:59
@dlrsp-actions
dlrsp-actions Bot force-pushed the dependabot/pip/poetry-2.4.3 branch from 4abe855 to da2c98f Compare September 22, 2026 13:06
@dependabot
chore(deps): bump poetry from 2.4.1 to 2.4.3
b054f46 
Bumps [poetry](https://github.com/python-poetry/poetry) from 2.4.1 to 2.4.3.
- [Release notes](https://github.com/python-poetry/poetry/releases)
- [Changelog](https://github.com/python-poetry/poetry/blob/main/CHANGELOG.md)
- [Commits](python-poetry/poetry@2.4.1...2.4.3)

---
updated-dependencies:
- dependency-name: poetry
  dependency-version: 2.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dlrsp-actions
dlrsp-actions Bot force-pushed the dependabot/pip/poetry-2.4.3 branch from da2c98f to b054f46 Compare September 22, 2026 13:19
@dependabot @github

dependabot Bot commented on behalf of github Sep 22, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #1422.

@dependabot dependabot Bot closed this Sep 22, 2026
auto-merge was automatically disabled September 22, 2026 20:25

Pull request was closed

@dependabot
dependabot Bot deleted the dependabot/pip/poetry-2.4.3 branch September 22, 2026 20:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dlrsp-actions dlrsp-actions[bot] dlrsp-actions[bot] approved these changes
@dlrsp-dev dlrsp-dev Awaiting requested review from dlrsp-dev dlrsp-dev is a code owner

Assignees

@dlrsp-dev dlrsp-dev

Labels

📦 dependencies Update of dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@dlrsp-dev