unstale

pypi / poetry

poetry

What changed in poetry 2, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-20.

1 breaking5 security1 new APIs and options8 performance1 behavior and defaults1 tooling31 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli on npm

poetry 248 changes

Breaking changes 1

  • When virtualenv creation is disabled, Poetry now errors if the current Python version is incompatible with the project.

    2.5.0release notes

Security 5

  • Credentials from a repository on another host are no longer used for git dependencies merely because the URL paths match.

    2.5.0release notes

  • Credentials configured for an https repository are no longer sent via http.

    2.5.0release notes

  • Fixes cases where credentials from the wrong repository were used when multiple repositories shared a host.

    2.5.0release notes

  • Poetry has Path Traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4

    2.3.4security advisory

  • Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write

    2.3.3security advisory

New APIs and options 1

  • Adds a setting to uninstall packages with a built-in uninstaller instead of invoking pip uninstall.

    2.5.0release notes

Performance 8

  • Dependency resolution is faster.

    2.5.0release notes

  • Schema validation is faster by caching compiled JSON schema validators.

    2.5.0release notes

  • Avoids redundant keyring lookups for repositories without credentials.

    2.5.0release notes

  • Processing package links and repository pages is faster.

    2.5.0release notes

  • Search is faster for single-token queries.

    2.5.0release notes

  • Startup is faster because the requests import is deferred.

    2.5.0release notes

  • Reduces the number of subprocesses used to discover virtual environment data.

    2.5.0release notes

  • Choosing and installing wheels is faster.

    2.5.0release notes

Behavior and default changes 1

  • Messages about already present packages now include the path of the pyproject.toml file.

    2.5.0release notes

Tooling 1

  • Python 3.15 is added to the automatically generated classifiers.

    2.5.0release notes

Fixes and other changes 31

  • Fixes a TypeError that occurred when uninstalling a package with this setting enabled.

    2.5.1release notes

  • The upper bound is corrected for ~= constraints on versions with more than three release segments.

    2.5.0release notes

  • Fixes resolution failures for conflicting requirements with mutually exclusive markers.

    2.5.0release notes

  • Fixes resolution failures when the same package is required with different extras in multiple optional dependencies or groups.

    2.5.0release notes

  • Fixes a dependency resolution failure that raised a KeyError.

    2.5.0release notes

  • Path and git dependencies are reinstalled when their develop setting changes.

    2.5.0release notes

  • Path dependencies no longer write a relative path to direct_url.json.

    2.5.0release notes

  • Scripts of type file are now installed when installing the project.

    2.5.0release notes

  • GUI scripts are now installed when installing the project.

    2.5.0release notes

  • Links created from Windows paths now have the correct filename, and filenames containing path separators are rejected.

    2.5.0release notes

  • Dependencies of an extra are no longer omitted from the lock file when the extra is added to a locked dependency in pyproject.toml.

    2.5.0release notes

  • Marker values containing spaces can now be parsed.

    2.5.0release notes

  • Merging platform_release markers with incompatible constraint types no longer fails.

    2.5.0release notes

  • Uses the environment determined by the application, including when using --directory.

    2.5.0release notes

  • Version constraints entered interactively are now validated.

    2.5.0release notes

  • No longer proposes an invalid package name when the directory name is not a valid package name.

    2.5.0release notes

  • poetry show <package> now displays a version relevant to the current environment when multiple versions are in the lock file.

    2.5.0release notes

  • The --outdated option now finds newer package versions from sources with explicit priority.

    2.5.0release notes

  • Adds official support for Python 3.15.

    2.5.0release notes

  • Formatting a Python constraint that only allows unknown Python versions no longer raises an IndexError.

    2.5.0release notes

  • Fixes cases where a <V constraint wrongly allowed pre-releases of V.

    2.5.0release notes

  • A != <value> constraint is no longer incorrectly considered to allow all values of a <value> not in constraint.

    2.5.0release notes

  • Subtracting a local version from a public version no longer allows that local version, avoiding a possible infinite loop during dependency resolution.

    2.5.0release notes

  • Ranges with coincident bounds are now recognized as empty.

    2.5.0release notes

  • Intersections between a version range and a local version now produce the correct constraint.

    2.5.0release notes

  • Ranges excluding some local versions of a public version are no longer incorrectly considered to allow all versions of that public version.

    2.5.0release notes

  • Stringifying a version range whose upper bound consists only of zeros no longer raises an IndexError.

    2.5.0release notes

  • The string representation of a version union now describes the same constraint when parsed again.

    2.5.0release notes

  • A union of a version range and a public version now includes all local versions of that public version.

    2.5.0release notes

  • The union of a public version and one of its local versions now results in the public version.

    2.5.0release notes

  • Fixed an issue preventing Poetry from extracting sdists on Python 3.10.0–3.10.12 and 3.11.0–3.11.4.

    2.4.3release notes