Fixed

• Fix an issue where uninstalling a package with installer.builtin-uninstall set failed with a TypeError (#11077).

Added

• Add an installer.builtin-uninstall setting to uninstall packages with a built-in uninstaller instead of invoking pip uninstall (#10931).
• Add official support for Python 3.15 (#11046).

Changed

• Do not send credentials configured for an https repository via http (#11073).
• Fail with an error when the current Python version is not compatible with the project and virtualenvs.create is false (#10941).
• Validate version constraints that are entered interactively in poetry init (#10909).
• Include the path of the pyproject.toml file in the message about already present packages in poetry add (#10908).
• Improve performance of processing package links and repository pages (#10895, #10896, #10903, #10949, #10951, #10953).
• Improve performance of dependency resolution (#10907, #10954).
• Improve performance of choosing and installing wheels (#10905,
  #10958).
• Improve performance by avoiding redundant keyring lookups for repositories without credentials (#10959).
• Improve performance by reducing the number of subprocesses to discover virtual environment data (#11042).
• Improve performance of poetry search for single-token queries (#10906).
• Improve startup time by deferring the import of requests (#11004).
• Improve performance of schema validation by caching compiled JSON schema validators (#11033).

Fixed

• Fix an issue where credentials of the wrong repository were used under certain circumstances when multiple repositories were configured on the same host (#11072).
• Fix an issue where credentials of a repository on another host were used for git dependencies if the path of the URL was the same (#11074).
• Fix an issue where dependency resolution failed for conflicting requirements of different packages even though the requirements had mutually exclusive markers (#10944).
• Fix an issue where dependency resolution failed when the same package was required with different extras in several optional dependencies or dependency groups (#10943).
• Fix an issue where dependency resolution failed with a KeyError (#11008).
• Fix an issue where the dependencies of an extra were missing in the lock file after adding the extra to a locked dependency, e.g. a git dependency, in the pyproject.toml file (#10987).
• Fix an issue where a path or git dependency was not reinstalled when its develop setting changed (#11022).
• Fix an issue where scripts of type file were not installed when installing the project (#10736).
• Fix an issue where GUI scripts were not installed when installing the project (#10973).
• Fix an issue where a relative path was written to direct_url.json for path dependencies (#10917).
• Fix an issue where poetry show <package> showed a version that was not relevant for the current environment if there were multiple versions of the package in the lock file (#11003).
• Fix an issue where poetry show --outdated did not find newer versions of packages from sources with explicit priority (#10982).
• Fix an issue where poetry env activate ignored the environment that was determined by the application, e.g. when using --directory (#10916).
• Fix an issue where poetry init proposed an invalid package name if the directory name was not a valid package name (#10975).

Docs

• Document the --license option of poetry init and poetry new (#11064).
• Clarify which dependencies are locked when running poetry update with dependency groups (#11024).
• Clarify the portability of path dependencies (#11020).
• Clarify the usage of poetry run with console scripts (#10984).
• Clarify what --no-cache disables (#10915).
• Document how to use package sources for poetry self update (#10923).
• Fix the stale minimum Python version (#11050).
• Update outdated links (#10913, #10938, #11000, #11043).

poetry-core (2.5.0)

• Add Python 3.15 to the automatically generated classifiers (#961).
• Fix an issue where a <V version constraint wrongly allowed pre-releases of V in some cases (#939).
• Fix an issue where version ranges with coincident bounds were not recognized as empty (#939).
• Fix an issue where the string representation of a version union did not describe the same constraint after being parsed again (#939).
• Fix an issue where the intersection of a version range with a local version resulted in a wrong constraint (#949).
• Fix an issue where the union of a version range and a public version did not include all local versions of the public version (#950).
• Fix an issue where the union of a public version and one of its local versions did not result in the public version (#966).
• Fix an issue where the difference between a public version and one of its local versions still allowed the local version, which could result in an infinite loop during dependency resolution (#953).
• Fix an issue where a version range that excluded some local versions of a public version was wrongly considered to allow all versions of the public version (#959).
• Fix an issue where a != <value> constraint was wrongly considered to allow all values of a <value> not in constraint (#955).
• Fix an issue where merging platform_release markers with incompatible constraint types failed (#956).
• Fix an issue where the string representation of a version range whose upper bound only consists of zeros raised an IndexError (#964).
• Fix an issue where formatting a Python constraint that only allows unknown Python versions raised an IndexError (#971).
• Fix an issue where marker values containing spaces could not be parsed (#972).
• Fix an issue where the upper bound of a ~= constraint was wrong for versions with more than three release segments (#973).
• Fix an issue where the filename of a link created from a Windows path was wrong and reject filenames containing path separators (#974).

Fixed

• Fix an issue where Poetry could not extract sdists on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 (#11037).

Fixed

• Fix an issue where Poetry installs an artifact that is not listed in the lockfile when the package source does not provide a hash for this artifact (#11030).
• Fix a path traversal vulnerability when downloading files from a compromised URL and/or package source (#11029).
• Fix a path traversal vulnerability in sdist extraction on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 that could allow malicious tarball files to write files outside the target directory (#11027).

Changed

• Re-allow installer==0.7.0 (#10887).

Fixed

• Fix an issue where poetry update <package> failed when <package> was a transitive dependency (#10885).

Added

• Add solver.min-release-age setting to require package releases to be a certain number of days old before they are considered during dependency resolution (#10824).
• Add solver.min-release-age-exclude to exclude selected packages from age filtering (#10824).
• Add solver.min-release-age-exclude-source to exclude all packages from selected package indexes from age filtering (#10824).

Changed

• Raise an error instead of silently ignoring a package name that is not a dependency when it is passed to poetry update (#10721).
• Automatically add a trailing slash to legacy repository URLs (used for publishing) if missing (#10785).
• Require installer>=1.0.0 (#10869).
• Allow findpython>=0.8 (#10874).

Fixed

• Fix an issue where requires-plugins fails on Windows if scheme paths are on different drives (#10869).
• Fix an issue where the order of markers in the lock file was not deterministic (#10720).
• Fix an issue where the wrong command was suggested when poetry self commands failed due to an outdated lock file (#10715).
• Fix an issue where poetry env activate did not work for bash on Windows (#10716).
• Fix an issue where poetry debug resolve failed when there was a package with a marker (#10807).
• Fix an issue where the error message about a build backend failure contained garbled --config-settings (#10804).
• Fix an issue where a false warning about a circular dependency was printed (#10811).
• Fix an issue where falsy config values were incorrectly treated as not set (#10808).
• Fix an issue where poetry publish --build ignored failing builds and uploaded stale artifacts (#10802).
• Fix an issue where poetry publish was aborted instead of retrying after package registration (#10801).
• Fix an issue where zip files were not closed after fetching metadata via lazy-wheel (#10800).
• Fix an issue where data fetched via lazy-wheel was corrupted when part of it had already been cached (#10806).
• Fix an issue where further packages were installed even though installation should be aborted (#10742).
• Fix an issue where installed packages without a METADATA file caused an exception on Python 3.15+ (#10860).
• Fix an issue where http-basic could not be set for repository names with periods (#10845).
• Fix an issue where calculating the hash of large wheels failed with a memory error (#10814).

Docs

• Clarify the precedence of configuration sources (#10757).
• Add a note about the influence of .gitignore on tool.poetry.packages (#10835).

poetry-core (2.4.0)

• Update vendored packaging to 26.2 (#936).

Fixed

• Fix a performance regression in the wheel installer that was introduced in Poetry 2.3.3 (#10821).
• Fix a path traversal vulnerability in sdist extraction on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 that could allow malicious tarball files to write files outside the target directory (#10837).

Fixed

• Fix a path traversal vulnerability in the wheel installer that could allow malicious wheel files to write files outside the intended installation directory (#10792).
• Fix an issue where git dependencies from annotated tags could not be updated (#10719).
• Fix an issue where empty VIRTUAL_ENV or CONDA_PREFIX environment variables (e.g., after conda deactivate) would cause Poetry to incorrectly detect an active virtualenv (#10784).
• Fix an issue where an incomprehensible error message was printed when .venv was a file instead of a directory (#10777).
• Fix an issue where HTTP Basic Authentication credentials could be corrupted during request preparation, causing authentication failures with long tokens (#10748).
• Fix an issue where poetry publish --no-interaction --build requested user interaction (#10769).
• Fix an issue where poetry init and poetry new created a deprecated project.license format (#10787).

Docs

• Clarify the differences between poetry install and poetry update (#10713).
• Clarify the section of fields in the pyproject.toml examples (#10753).
• Add a note about the different installation location when Python from the Microsoft Store is used (#10759).
• Fix the system requirements for Poetry (#10739).
• Fix the poetry cache clear example (#10749).
• Fix the link to pipx installation instructions (#10783).

poetry-core (2.3.2)

• Fix an issue where platform_release could not be parsed on Debian Trixie (#930).
• Fix an issue where using project.readme.text in the pyproject.toml file resulted in broken metadata (#914).
• Fix an issue where dependency groups were considered equal when their resolved dependencies were equal, even if the groups themselves were not (#919).
• Fix an issue where removing a dependency from a group that included another group resulted in other dependencies being added to the included group (#922).
• Fix an issue where PEP 735 include-group entries were lost when [tool.poetry.group] also defined include-groups for the same group (#924).
• Fix an issue where the union of <value> not in <marker> constraints was wrongly treated as always satisfied (#925).
• Fix an issue where a post release with a local version identifier was wrongly allowed by a > version constraint (#921).
• Fix an issue where a version with the local version identifier 0 was treated as equal to the corresponding public version (#920).
• Fix an issue where a != <version> constraint wrongly disallowed pre releases and post releases of the specified version (#929).
• Fix an issue where in and not in constraints were wrongly not allowed by specific compound constraints (#927).

Changed

• Allow dulwich>=1.0 (#10701).

poetry-core (2.3.1)

• Fix an issue where platform_release could not be parsed on Windows Server (#911).

Fixed

• Fix an issue where cached information about each package was always considered outdated (#10699).

Docs

• Document SHELL_VERBOSITY environment variable (#10678).