Skip to content

chore(deps): bump poetry from 2.4.1 to 2.4.2 - #314

Merged
mergify[bot] merged 1 commit into
mainfrom
dependabot/pip/poetry-2.4.2
Sep 7, 2026
Merged

mergify[bot] merged 1 commit into
mainfrom
dependabot/pip/poetry-2.4.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor

Bumps poetry from 2.4.1 to 2.4.2.

Release notes

Sourced from poetry's releases.

2.4.2

Fixed

  • Fix an issue where Poetry installs an artifact that is not listed in the lockfile when the package source does not provide a hash for this artifact (#11030).
  • Fix a path traversal vulnerability when downloading files from a compromised URL and/or package source (#11029).
  • Fix a path traversal vulnerability in sdist extraction on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 that could allow malicious tarball files to write files outside the target directory (#11027).
Changelog

Sourced from poetry's changelog.

[2.4.2] - 2026-08-29

Fixed

  • Fix an issue where Poetry installs an artifact that is not listed in the lockfile when the package source does not provide a hash for this artifact (#11030).
  • Fix a path traversal vulnerability when downloading files from a compromised URL and/or package source (#11029).
  • Fix a path traversal vulnerability in sdist extraction on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 that could allow malicious tarball files to write files outside the target directory (#11027).
Commits
  • 15ce1fc release: bump version to 2.4.2
  • 3dd0f2d perf: avoid unnecessary downloads when the index does not provide hashes
  • c2f9af2 Fail closed when a locked hash cannot be checked
  • 3a194dd fix: reject invalid link filenames when downloading files (#11029)
  • 22173fd fix: refuse to write files outside the target directory during sdist extracti...
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [poetry](https://github.com/python-poetry/poetry) from 2.4.1 to 2.4.2.
- [Release notes](https://github.com/python-poetry/poetry/releases)
- [Changelog](https://github.com/python-poetry/poetry/blob/main/CHANGELOG.md)
- [Commits](python-poetry/poetry@2.4.1...2.4.2)

---
updated-dependencies:
- dependency-name: poetry
  dependency-version: 2.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Sep 7, 2026
@mergify
mergify Bot deployed to Mergify Merge Protections September 7, 2026 07:04 Active
@mergify

mergify Bot commented Sep 7, 2026 •

Copy link
Copy Markdown
Contributor

Merge Protections

🟢 All 6 merge protections satisfied — ready to merge.

Show 6 satisfied protections

🟢 🤖 Continuous Integration

  • all of:
    • check-success=Test with Python 3.10
    • check-success=Test with Python 3.11
    • check-success=Test with Python 3.12
    • check-success=Test with Python 3.13
    • check-success=Test with Python 3.14
    • check-success=semgrep

🟢 👀 Review Requirements

  • any of:
    • author = dependabot[bot]
    • #approved-reviews-by>=1

🟢 Enforce conventional commit

Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/

  • title ~= ^(fix|feat|internal|docs|style|refactor|perf|test|build|ci|chore|revert|ui)(?:\(.+\))?!?:

🟢 🔎 Reviews

  • #changes-requested-reviews-by = 0
  • #review-requested = 0
  • #review-threads-unresolved = 0

🟢 📕 PR description

  • body ~= (?ms:.{48,})

🟢 🚦 Auto-queue

When all merge protections are satisfied, this pull request will be queued automatically.

@mergify

mergify Bot commented Sep 7, 2026 •

Copy link
Copy Markdown
Contributor

Merge Queue Status

  • ✅ Entered queue — 2026-09-07 07:05 UTC · Rule: dependencies · triggered by merge protections
  • ✅ Checks skipped · PR is already up-to-date
  • ✅ Merged — 2026-09-07 07:11 UTC · at 1ba34c235051bdc711793701fc45eb3ecf86b55e · fast-forward

This pull request spent 5 minutes 30 seconds in the queue, including 3 seconds running CI.

Required conditions to merge

@mergify mergify Bot added the queued label Sep 7, 2026
@mergify
mergify Bot merged commit 1ba34c2 into main Sep 7, 2026
8 checks passed
@mergify
mergify Bot deleted the dependabot/pip/poetry-2.4.2 branch September 7, 2026 07:11
@mergify mergify Bot removed the queued label Sep 7, 2026

This branch was successfully deployed

1 active deployment
Mergify Merge Protections — 1ba34c23 Deployed Sep 7, 2026 by mergify[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Development

Successfully merging this pull request may close these issues.

0 participants