build(deps-dev): bump poetry from 2.3.2 to 2.3.3
Metadata
Current evaluation
Dependabot bump of dev dependency poetry 2.3.2→2.3.3 was closed unmerged by lengau as a duplicate of #2624, which already applied the same poetry security update to main (commit 5b858d29; also #2628 on hotfix/4.2, 36f30ad6).
Resolution: closed superseded
Reason: Maintainer lengau closed it with "Duplicates #2624" and Dependabot confirmed it would stop notifying. The identical poetry 2.3.3 security update was merged via canonical/charmcraft#2624 (commit 5b858d29) on main, with #2628 doing the same on hotfix/4.2.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Bumps [poetry](https://github.com/python-poetry/poetry) from 2.3.2 to 2.3.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/python-poetry/poetry/releases">poetry's releases</a>.</em></p>
<blockquote>
<h2>2.3.3</h2>
<h3>Fixed</h3>
<ul>
<li><strong>Fix a path traversal vulnerability in the wheel installer that could allow malicious wheel files to write files outside the intended installation directory</strong> (<a href="https://redirect.github.com/python-poetry/poetry/pull/10792">#10792</a>).</li>
<li>Fix an issue where <code>git</code> dependencies from annotated tags could not be updated (<a href="https://redirect.github.com/python-poetry/poetry/pull/10719">#10719</a>).</li>
<li>Fix an issue where empty <code>VIRTUAL_ENV</code> or <code>CONDA_PREFIX</code> environment variables (e.g., after <code>conda deactivate</code>) would cause Poetry to incorrectly detect an active virtualenv (<a href="https://redirect.github.com/python-poetry/poetry/pull/10784">#10784</a>).</li>
<li>Fix an issue where an incomprehensible error message was printed when <code>.venv</code> was a file instead of a directory (<a href="https://redirect.github.com/python-poetry/poetry/pull/10777">#10777</a>).</li>
<li>Fix an issue where HTTP Basic Authentication credentials could be corrupted during request preparation, causing authentication failures with long tokens (<a href="https://redirect.github.com/python-poetry/poetry/pull/10748">#10748</a>).</li>
<li>Fix an issue where <code>poetry publish --no-interaction --build</code> requested user interaction (<a href="https://redirect.github.com/python-poetry/poetry/pull/10769">#10769</a>).</li>
<li>Fix an issue where <code>poetry init</code> and <code>poetry new</code> created a deprecated <code>project.license</code> format (<a href="https://redirect.github.com/python-poetry/poetry/pull/10787">#10787</a>).</li>
</ul>
<h3>Docs</h3>
<ul>
<li>Clarify the differences between <code>poetry install</code> and <code>poetry update</code> (<a href="https://redirect.github.com/python-poetry/poetry/pull/10713">#10713</a>).</li>
<li>Clarify the section of fields in the <code>pyproject.toml</code> examples (<a href="https://redirect.github.com/python-poetry/poetry/pull/10753">#10753</a>).</li>
<li>Add a note about the different installation location when Python from the Microsoft Store is used (<a href="https://redirect.github.com/python-poetry/poetry/pull/10759">#10759</a>).</li>
<li>Fix the system requirements for Poetry (<a href="https://redirect.github.com/python-poetry/poetry/pull/10739">#10739</a>).</li>
<li>Fix the <code>poetry cache clear</code> example (<a href="https://redirect.github.com/python-poetry/poetry/pull/10749">#10749</a>).</li>
<li>Fix the link to <code>pipx</code> installation instructions (<a href="https://redirect.github.com/python-poetry/poetry/pull/10783">#10783</a>).</li>
</ul>
<h3>poetry-core (<a href="https://github.com/python-poetry/poetry-core/releases/tag/2.3.2"><code>2.3.2</code></a>)</h3>
<ul>
<li>Fix an issue where <code>platform_release</code> could not be parsed on Debian Trixie (<a href="https://redirect.github.com/python-poetry/poetry-core/pull/930">#930</a>).</li>
<li>Fix an issue where using <code>project.readme.text</code> in the <code>pyproject.toml</code> file resulted in broken metadata (<a href="https://redirect.github.com/python-poetry/poetry-core/pull/914">#914</a>).</li>
<li>Fix an issue where dependency groups were considered equal when their resolved dependencies were equal, even if the groups themselves were not (<a href="https://redirect.github.com/python-poetry/poetry-core/pull/919">#919</a>).</li>
<li>Fix an issue where removing a dependency from a group that included another group resulted in other dependencies being added to the included group (<a href="https://redirect.github.com/python-poetry/poetry-core/pull/922">#922</a>).</li>
<li>Fix an issue where PEP 735 <code>include-group</code> entries were lost when <code>[tool.poetry.group]</code> also defined <code>include-groups</code> for the same group (<a href="https://redirect.github.com/python-poetry/poetry-core/pull/924">#924</a>).</li>
<li>Fix an issue where the union of <code><value> not in <marker></code> constraints was wrongly treated as always satisfied (<a href="https://redirect.github.com/python-poetry/poetry-core/pull/925">#925</a>).</li>
<li>Fix an issue where a post release with a local version identifier was wrongly allowed by a <code>></code> version constraint (<a href="https://redirect.github.com/python-poetry/poetry-core/pull/921">#921</a>).</li>
<li>Fix an issue where a version with the local version identifier <code>0</code> was treated as equal to the corresponding public version (<a href="https://redirect.github.com/python-poetry/poetry-core/pull/920">#920</a>).</li>
<li>Fix an issue where a <code>!= <version></code> constraint wrongly disallowed pre releases and post releases of the specified version (<a href="https://redirect.github.com/python-poetry/poetry-core/pull/929">#929</a>).</li>
<li>Fix an issue where <code>in</code> and <code>not in</code> constraints were wrongly not allowed by specific compound constraints (<a href="https://redirect.github.com/python-poetry/poetry-core/pull/927">#927</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/python-poetry/poetry/blob/main/CHANGELOG.md">poetry's changelog</a>.</em></p>
<blockquote>
<h2>[2.3.3] - 2026-03-29</h2>
<h3>Fixed</h3>
<ul>
<li><strong>Fix a path traversal vulnerability in the wheel installer that could allow malicious wheel files to write files outside the intended installation directory</strong> (<a href="https://redirect.github.com/python-poetry/poetry/pull/10792">#10792</a>).</li>
<li>Fix an issue where <code>git</code> dependencies from annotated tags could not be updated (<a href="https://redirect.github.com/python-poetry/poetry/pull/10719">#10719</a>).</li>
<li>Fix an issue where empty <code>VIRTUAL_ENV</code> or <code>CONDA_PREFIX</code> environment variables (e.g., after <code>conda deactivate</code>) would cause Poetry to incorrectly detect an active virtualenv (<a href="https://redirect.github.com/python-poetry/poetry/pull/10784">#10784</a>).</li>
<li>Fix an issue where an incomprehensible error message was printed when <code>.venv</code> was a file instead of a directory (<a href="https://redirect.github.com/python-poetry/poetry/pull/10777">#10777</a>).</li>
<li>Fix an issue where HTTP Basic Authentication credentials could be corrupted during request preparation, causing authentication failures with long tokens (<a href="https://redirect.github.com/python-poetry/poetry/pull/10748">#10748</a>).</li>
<li>Fix an issue where <code>poetry publish --no-interaction --build</code> requested user interaction (<a href="https://redirect.github.com/python-poetry/poetry/pull/10769">#10769</a>).</li>
<li>Fix an issue where <code>poetry init</code> and <code>poetry new</code> created a deprecated <code>project.license</code> format (<a href="https://redirect.github.com/python-poetry/poetry/pull/10787">#10787</a>).</li>
</ul>
<h3>Docs</h3>
<ul>
<li>Clarify the differences between <code>poetry install</code> and <code>poetry update</code> (<a href="https://redirect.github.com/python-poetry/poetry/pull/10713">#10713</a>).</li>
<li>Clarify the section of fields in the <code>pyproject.toml</code> examples (<a href="https://redirect.github.com/python-poetry/poetry/pull/10753">#10753</a>).</li>
<li>Add a note about the different installation location when Python from the Microsoft Store is used (<a href="https://redirect.github.com/python-poetry/poetry/pull/10759">#10759</a>).</li>
<li>Fix the system requirements for Poetry (<a href="https://redirect.github.com/python-poetry/poetry/pull/10739">#10739</a>).</li>
<li>Fix the <code>poetry cache clear</code> example (<a href="https://redirect.github.com/python-poetry/poetry/pull/10749">#10749</a>).</li>
<li>Fix the link to <code>pipx</code> installation instructions (<a href="https://redirect.github.com/python-poetry/poetry/pull/10783">#10783</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/python-poetry/poetry/commit/3d0151ac03b5286e557ed1518b815ad225d52cb0"><code>3d0151a</code></a> release: bump version to 2.3.3</li>
<li><a href="https://github.com/python-poetry/poetry/commit/89f09aad49ed7e6223ea2b8ebdf941e87bb5d5c6"><code>89f09aa</code></a> fix long path issue on Windows (<a href="https://redirect.github.com/python-poetry/poetry/issues/10794">#10794</a>)</li>
<li><a href="https://github.com/python-poetry/poetry/commit/e068177d1bfef65de4c55cf71c36de27057f10e7"><code>e068177</code></a> installer: fix path traversal (<a href="https://redirect.github.com/python-poetry/poetry/issues/10792">#10792</a>)</li>
<li><a href="https://github.com/python-poetry/poetry/commit/d76a2f67641ef1499065bdc8a0246448cbcf781c"><code>d76a2f6</code></a> chore: require new poetry-core version (<a href="https://redirect.github.com/python-poetry/poetry/issues/10790">#10790</a>)</li>
<li><a href="https://github.com/python-poetry/poetry/commit/859d4439f2caf147010330beae1ad61274f009d4"><code>859d443</code></a> Update init & new commands for PEP 639 (License) (<a href="https://redirect.github.com/python-poetry/poetry/issues/10787">#10787</a>)</li>
<li><a href="https://github.com/python-poetry/poetry/commit/2ff2845af03539c98d2279b46074c908594427c4"><code>2ff2845</code></a> fix: pass auth via Request constructor instead of calling HTTPBasicAuth on un...</li>
<li><a href="https://github.com/python-poetry/poetry/commit/286e43bba52ba60205e1e5c9a401019b45226bbe"><code>286e43b</code></a> env: improve error handling if <code>.venv</code> is not a directory but a file (<a href="https://redirect.github.com/python-poetry/poetry/issues/10777">#10777</a>)</li>
<li><a href="https://github.com/python-poetry/poetry/commit/d6e72c972a48c4db98e1b8e1381544d33a2b66ef"><code>d6e72c9</code></a> Fix <code>publish --build</code> prompt behavior in non-interactive mode (<a href="https://redirect.github.com/python-poetry/poetry/issues/10769">#10769</a>)</li>
<li><a href="https://github.com/python-poetry/poetry/commit/9fced1a13ded1a7dcec562f295b2362a1a4fa8dc"><code>9fced1a</code></a> fix(env): treat empty VIRTUAL_ENV/CONDA_PREFIX as unset (<a href="https://redirect.github.com/python-poetry/poetry/issues/10784">#10784</a>)</li>
<li><a href="https://github.com/python-poetry/poetry/commit/96883826998f964ae12963fac0b4751bedd04b50"><code>9688382</code></a> docs: fix pipx install directions link (<a href="https://redirect.github.com/python-poetry/poetry/issues/10783">#10783</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/python-poetry/poetry/compare/2.3.2...2.3.3">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/canonical/charmcraft/network/alerts).
</details>
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed superseded | Dependabot bump of dev dependency poetry 2.3.2→2.3.3 was closed unmerged by lengau as a duplicate of #2624, which already applied the same poetry security update to main (commit 5b858d29; also #2628 on hotfix/4.2, 36f30ad6). | |
| stealth/space-bunny-alpha | — | closed superseded | Closed as a duplicate of merged PR #2624, which updated Poetry from 2.3.2 to 2.3.3 to address its wheel-installer path-traversal vulnerability. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed as a duplicate of PR #2624. Dependabot acknowledged the closure and will skip future notifications. The dependency update was handled in the referenced PR. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Closed as a duplicate of #2624. Dependabot acknowledged the closure and will skip further notifications for this release. The dependency update was resolved through the referenced duplicate. |
Update history
No update history recorded yet.
Related work
-
Duplicate Of:
canonical/charmcraft#2624
(confidence 98%)
Maintainer comment 'Duplicates #2624'; #2624 merged the same poetry 2.3.3 security bump via 5b858d29.
-
Superseded By:
canonical/charmcraft#2628
(confidence 70%)
Parallel poetry 2.3.3 security update merged on hotfix/4.2 (36f30ad6), covering backports this PR's branch was not needed for.
-
Related To:
canonical/charmcraft#2625
(confidence 45%)
Sibling Dependabot poetry 2.3.3 PR for hotfix/3.5, autoclosed unmerged.
-
Related To:
canonical/charmcraft#2626
(confidence 45%)
Sibling Dependabot poetry 2.3.3 PR for hotfix/4.0, closed unmerged after test failures.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #2627 build(deps): update dependency poetry to v2.3.3 [security] (hotfix/4.1) | charmcraft | closed | Closed unmerged after equivalent Poetry 2.3.3 security updates merged in #2624 (5b858d29) for main and #2628 (36f30ad6) for hotfix/4.2. | |
| #2626 build(deps): update dependency poetry to v2.3.3 [security] (hotfix/4.0) | charmcraft | closed | Renovate PR #2626 (Poetry 2.1.4→2.3.3, CVE-2026-34591 fix, hotfix/4.0) was closed unmerged; the same upgrade merged in #2624 (5b858d29, main) and #2628 (36f30ad6, hotfix/4.2). | |
| #2625 build(deps): update dependency poetry to v2.3.3 [security] (hotfix/3.5) - autoclosed | charmcraft | closed | Renovate's Poetry 2.3.3 security bump for hotfix/3.5 was autoclosed unmerged; the same CVE-2026-34591 fix landed via #2624 (5b858d29) on main and #2628 (36f30ad6) on hotfix/4.2. | |
| #2624 build(deps): update dependency poetry to v2.3.3 [security] (main) | charmcraft | merged | Renovate security bump of poetry 2.3.2 -> 2.3.3 (CVE-2026-34591 path traversal in wheel installer) merged into main via commit 5b858d29; +6/-6 in pyproject.toml. Equivalent backport landed as #2628 (36f30ad6). | |
| #1169 build(deps): update dependency poetry to v2.3.3 [security] (hotfix/1.17) - autoclosed | rockcraft | closed | Renovate's Poetry 2.3.3 security bump for hotfix/1.17 was autoclosed unmerged, so #1169 did not deliver the CVE-2026-34591 remediation. Later #1278 may have covered the fix. | |
| #1168 build(deps): update dependency poetry to v2.3.3 [security] (main) - autoclosed | rockcraft | closed | Renovate's Poetry 2.3.3 security bump was autoclosed unmerged after snap-tests failed; later OSV cleanup landed in #1278 (f0b08615). | |
| #2628 build(deps): update dependency poetry to v2.3.3 [security] (hotfix/4.2) | charmcraft | merged | Merged in charmcraft#2628 via commit 36f30ad6, upgrading Poetry 2.3.2 to 2.3.3 to remediate CVE-2026-34591's malicious-wheel path traversal vulnerability. | |
| #901 fix(poetry): don't install poetry with poetry-deps | craft-parts | merged | PR #901 merged as commit 2eda2a5a: the Poetry plugin skips adding python3-poetry (and the export plugin) to build packages when a poetry-deps part supplies them. Fixes charmcraft#1996 (CRAFT-3687); noted in the 2.34.1 changelog. |