# What changed in poetry

> 48 changes in poetry 2 from its official release notes, upgrade guides and advisories: 1 breaking, 5 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-20. HTML: https://unstale.sh/pypi/poetry/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## poetry 2

### Breaking changes

- When virtualenv creation is disabled, Poetry now errors if the current Python version is incompatible with the project. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)

### Security

- Credentials from a repository on another host are no longer used for git dependencies merely because the URL paths match. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Credentials configured for an https repository are no longer sent via http. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Fixes cases where credentials from the wrong repository were used when multiple repositories shared a host. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Poetry has Path Traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4 (2.3.4) — [security advisory](https://github.com/advisories/GHSA-73H3-MF4W-8647)
- Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write (2.3.3) — [security advisory](https://github.com/advisories/GHSA-2599-H6XX-HPXP)

### New APIs and options

- Adds a setting to uninstall packages with a built-in uninstaller instead of invoking pip uninstall. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)

### Performance

- Dependency resolution is faster. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Schema validation is faster by caching compiled JSON schema validators. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Avoids redundant keyring lookups for repositories without credentials. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Processing package links and repository pages is faster. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Search is faster for single-token queries. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Startup is faster because the requests import is deferred. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Reduces the number of subprocesses used to discover virtual environment data. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Choosing and installing wheels is faster. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)

### Behavior and default changes

- Messages about already present packages now include the path of the pyproject.toml file. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)

### Tooling

- Python 3.15 is added to the automatically generated classifiers. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)

### Fixes and other changes

- Fixes a TypeError that occurred when uninstalling a package with this setting enabled. (2.5.1) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.1)
- The upper bound is corrected for ~= constraints on versions with more than three release segments. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Fixes resolution failures for conflicting requirements with mutually exclusive markers. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Fixes resolution failures when the same package is required with different extras in multiple optional dependencies or groups. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Fixes a dependency resolution failure that raised a KeyError. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Path and git dependencies are reinstalled when their develop setting changes. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Path dependencies no longer write a relative path to direct_url.json. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Scripts of type file are now installed when installing the project. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- GUI scripts are now installed when installing the project. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Links created from Windows paths now have the correct filename, and filenames containing path separators are rejected. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Dependencies of an extra are no longer omitted from the lock file when the extra is added to a locked dependency in pyproject.toml. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Marker values containing spaces can now be parsed. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Merging platform_release markers with incompatible constraint types no longer fails. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Uses the environment determined by the application, including when using --directory. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Version constraints entered interactively are now validated. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- No longer proposes an invalid package name when the directory name is not a valid package name. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- poetry show <package> now displays a version relevant to the current environment when multiple versions are in the lock file. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- The --outdated option now finds newer package versions from sources with explicit priority. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Adds official support for Python 3.15. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Formatting a Python constraint that only allows unknown Python versions no longer raises an IndexError. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Fixes cases where a <V constraint wrongly allowed pre-releases of V. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- A != <value> constraint is no longer incorrectly considered to allow all values of a <value> not in constraint. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Subtracting a local version from a public version no longer allows that local version, avoiding a possible infinite loop during dependency resolution. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Ranges with coincident bounds are now recognized as empty. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Intersections between a version range and a local version now produce the correct constraint. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Ranges excluding some local versions of a public version are no longer incorrectly considered to allow all versions of that public version. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Stringifying a version range whose upper bound consists only of zeros no longer raises an IndexError. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- The string representation of a version union now describes the same constraint when parsed again. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- A union of a version range and a public version now includes all local versions of that public version. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- The union of a public version and one of its local versions now results in the public version. (2.5.0) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.5.0)
- Fixed an issue preventing Poetry from extracting sdists on Python 3.10.0–3.10.12 and 3.11.0–3.11.4. (2.4.3) — [release notes](https://github.com/python-poetry/poetry/releases/tag/2.4.3)