[dependabot]

Bumps poetry from 2.4.1 to 2.5.1.

Release notes

Sourced from poetry's releases.

2.5.1

Fixed

• Fix an issue where uninstalling a package with installer.builtin-uninstall set failed with a TypeError (#11077).

2.5.0

Added

• Add an installer.builtin-uninstall setting to uninstall packages with a built-in uninstaller instead of invoking pip uninstall (#10931).
• Add official support for Python 3.15 (#11046).

Changed

• Do not send credentials configured for an https repository via http (#11073).
• Fail with an error when the current Python version is not compatible with the project and virtualenvs.create is false (#10941).
• Validate version constraints that are entered interactively in poetry init (#10909).
• Include the path of the pyproject.toml file in the message about already present packages in poetry add (#10908).
• Improve performance of processing package links and repository pages (#10895, #10896, #10903, #10949, #10951, #10953).
• Improve performance of dependency resolution (#10907, #10954).
• Improve performance of choosing and installing wheels (#10905, #10958).
• Improve performance by avoiding redundant keyring lookups for repositories without credentials (#10959).
• Improve performance by reducing the number of subprocesses to discover virtual environment data (#11042).
• Improve performance of poetry search for single-token queries (#10906).
• Improve startup time by deferring the import of requests (#11004).
• Improve performance of schema validation by caching compiled JSON schema validators (#11033).

Fixed

• Fix an issue where credentials of the wrong repository were used under certain circumstances when multiple repositories were configured on the same host (#11072).
• Fix an issue where credentials of a repository on another host were used for git dependencies if the path of the URL was the same (#11074).
• Fix an issue where dependency resolution failed for conflicting requirements of different packages even though the requirements had mutually exclusive markers (#10944).
• Fix an issue where dependency resolution failed when the same package was required with different extras in several optional dependencies or dependency groups (#10943).
• Fix an issue where dependency resolution failed with a KeyError (#11008).
• Fix an issue where the dependencies of an extra were missing in the lock file after adding the extra to a locked dependency, e.g. a git dependency, in the pyproject.toml file (#10987).
• Fix an issue where a path or git dependency was not reinstalled when its develop setting changed (#11022).
• Fix an issue where scripts of type file were not installed when installing the project (#10736).
• Fix an issue where GUI scripts were not installed when installing the project (#10973).
• Fix an issue where a relative path was written to direct_url.json for path dependencies (#10917).
• Fix an issue where poetry show <package> showed a version that was not relevant for the current environment if there were multiple versions of the package in the lock file (#11003).
• Fix an issue where poetry show --outdated did not find newer versions of packages from sources with explicit priority (#10982).
• Fix an issue where poetry env activate ignored the environment that was determined by the application, e.g. when using --directory (#10916).
• Fix an issue where poetry init proposed an invalid package name if the directory name was not a valid package name (#10975).

Docs

• Document the --license option of poetry init and poetry new (#11064).
• Clarify which dependencies are locked when running poetry update with dependency groups (#11024).
• Clarify the portability of path dependencies (#11020).
• Clarify the usage of poetry run with console scripts (#10984).

... (truncated)

Changelog

Sourced from poetry's changelog.

[2.5.1] - 2026-09-20

Fixed

• Fix an issue where uninstalling a package with installer.builtin-uninstall set failed with a TypeError (#11077).

[2.5.0] - 2026-09-19

Added

• Add an installer.builtin-uninstall setting to uninstall packages with a built-in uninstaller instead of invoking pip uninstall (#10931).
• Add official support for Python 3.15 (#11046).

Changed

• Do not send credentials configured for an https repository via http (#11073).
• Fail with an error when the current Python version is not compatible with the project and virtualenvs.create is false (#10941).
• Validate version constraints that are entered interactively in poetry init (#10909).
• Include the path of the pyproject.toml file in the message about already present packages in poetry add (#10908).
• Improve performance of processing package links and repository pages (#10895, #10896, #10903, #10949, #10951, #10953).
• Improve performance of dependency resolution (#10907, #10954).
• Improve performance of choosing and installing wheels (#10905, #10958).
• Improve performance by avoiding redundant keyring lookups for repositories without credentials (#10959).
• Improve performance by reducing the number of subprocesses to discover virtual environment data (#11042).
• Improve performance of poetry search for single-token queries (#10906).
• Improve startup time by deferring the import of requests (#11004).
• Improve performance of schema validation by caching compiled JSON schema validators (#11033).

Fixed

• Fix an issue where credentials of the wrong repository were used under certain circumstances when multiple repositories were configured on the same host (#11072).
• Fix an issue where credentials of a repository on another host were used for git dependencies if the path of the URL was the same (#11074).
• Fix an issue where dependency resolution failed for conflicting requirements of different packages even though the requirements had mutually exclusive markers (#10944).
• Fix an issue where dependency resolution failed when the same package was required with different extras in several optional dependencies or dependency groups (#10943).
• Fix an issue where dependency resolution failed with a KeyError (#11008).
• Fix an issue where the dependencies of an extra were missing in the lock file after adding the extra to a locked dependency, e.g. a git dependency, in the pyproject.toml file (#10987).
• Fix an issue where a path or git dependency was not reinstalled when its develop setting changed (#11022).
• Fix an issue where scripts of type file were not installed when installing the project (#10736).
• Fix an issue where GUI scripts were not installed when installing the project (#10973).
• Fix an issue where a relative path was written to direct_url.json for path dependencies (#10917).
• Fix an issue where poetry show <package> showed a version that was not relevant for the current environment if there were multiple versions of the package in the lock file (#11003).
• Fix an issue where poetry show --outdated did not find newer versions of packages from sources with explicit priority (#10982).

... (truncated)

Commits

• 94b6e35 release: bump version to 2.5.1
• f8408ca fix TypeError when using installer.builtin-uninstall (#11077)
• 165fb4b release: bump version to 2.5.0
• c93fd63 update poetry-core (#10921)
• 32356ae chore: update dependencies (#11075)
• d266d45 test: accept compatible extension wheel tags (#11014)
• c8790a3 add Python 3.15 to tests matrix (#11046)
• a416efd authenticator: match host when looking up git credentials (#11074)
• e078ebf authenticator: do not send credentials configured for https with http (#11073)
• 8711c83 authenticator: sort candidates by common path segments instead of prefixes (#...
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[dlrsp-actions]

Policy gate blocked this PR: default-fail: matched catch-all policy

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

[dlrsp-actions]

Policy gate blocked this PR: default-fail: matched catch-all policy

[github-actions]

Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

requirements/py314-django52.txt

Name	Version	Vulnerability	Severity
filelock	4.1.0	filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files	high

Only included vulnerabilities with severity high or higher.

License Issues

requirements/py314-django52.txt

Package	Version	License	Issue Type
backports-tarfile	1.2.0	Null	Unknown License

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
pip/poetry	2.5.1	Unknown	Unknown
pip/poetry-core	2.5.0	Unknown	Unknown
pip/filelock	4.1.0	Unknown	Unknown
pip/backports-tarfile	1.2.0	Unknown	Unknown
pip/backports-zstd	1.8.0	Unknown	Unknown
pip/exceptiongroup	1.3.1	Unknown	Unknown
pip/httpcore2	2.14.0	Unknown	Unknown
pip/httpx2	2.14.0	Unknown	Unknown
pip/importlib-metadata	9.0.1	Unknown	Unknown
pip/more-itertools	11.1.0	Unknown	Unknown
pip/platformdirs	4.12.4	Unknown	Unknown
pip/pydantic-settings	2.15.0	Unknown	Unknown
pip/rapidfuzz	3.14.5	Unknown	Unknown
pip/tomli	2.5.0	Unknown	Unknown
pip/zipp	4.1.1	Unknown	Unknown

Scanned Files

• requirements/py312-django32.txt
• requirements/py314-django52.txt

[dlrsp-dev]

Closing conflicted Dependabot bump. Dependency review also fails on transitive filelock high CVE on main locks — recreate after that is fixed on main.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.