poetry

Fixed

• Fix an issue where Poetry could not extract sdists on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 (#11037).

Fixed

• Fix an issue where Poetry installs an artifact that is not listed in the lockfile when the package source does not provide a hash for this artifact (#11030).
• Fix a path traversal vulnerability when downloading files from a compromised URL and/or package source (#11029).
• Fix a path traversal vulnerability in sdist extraction on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 that could allow malicious tarball files to write files outside the target directory (#11027).

Changed

• Re-allow installer==0.7.0 (#10887).

Fixed

• Fix an issue where poetry update <package> failed when <package> was a transitive dependency (#10885).

Added

• Add solver.min-release-age setting to require package releases to be a certain number of days old before they are considered during dependency resolution (#10824).
• Add solver.min-release-age-exclude to exclude selected packages from age filtering (#10824).
• Add solver.min-release-age-exclude-source to exclude all packages from selected package indexes from age filtering (#10824).

Changed

• Raise an error instead of silently ignoring a package name that is not a dependency when it is passed to poetry update (#10721).
• Automatically add a trailing slash to legacy repository URLs (used for publishing) if missing (#10785).
• Require installer>=1.0.0 (#10869).
• Allow findpython>=0.8 (#10874).

Fixed

• Fix an issue where requires-plugins fails on Windows if scheme paths are on different drives (#10869).
• Fix an issue where the order of markers in the lock file was not deterministic (#10720).
• Fix an issue where the wrong command was suggested when poetry self commands failed due to an outdated lock file (#10715).
• Fix an issue where poetry env activate did not work for bash on Windows (#10716).
• Fix an issue where poetry debug resolve failed when there was a package with a marker (#10807).
• Fix an issue where the error message about a build backend failure contained garbled --config-settings (#10804).
• Fix an issue where a false warning about a circular dependency was printed (#10811).
• Fix an issue where falsy config values were incorrectly treated as not set (#10808).
• Fix an issue where poetry publish --build ignored failing builds and uploaded stale artifacts (#10802).
• Fix an issue where poetry publish was aborted instead of retrying after package registration (#10801).
• Fix an issue where zip files were not closed after fetching metadata via lazy-wheel (#10800).
• Fix an issue where data fetched via lazy-wheel was corrupted when part of it had already been cached (#10806).
• Fix an issue where further packages were installed even though installation should be aborted (#10742).
• Fix an issue where installed packages without a METADATA file caused an exception on Python 3.15+ (#10860).
• Fix an issue where http-basic could not be set for repository names with periods (#10845).
• Fix an issue where calculating the hash of large wheels failed with a memory error (#10814).

Docs

• Clarify the precedence of configuration sources (#10757).
• Add a note about the influence of .gitignore on tool.poetry.packages (#10835).

poetry-core (2.4.0)

• Update vendored packaging to 26.2 (#936).

Fixed

• Fix a performance regression in the wheel installer that was introduced in Poetry 2.3.3 (#10821).
• Fix a path traversal vulnerability in sdist extraction on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 that could allow malicious tarball files to write files outside the target directory (#10837).

Fixed

• Fix a path traversal vulnerability in the wheel installer that could allow malicious wheel files to write files outside the intended installation directory (#10792).
• Fix an issue where git dependencies from annotated tags could not be updated (#10719).
• Fix an issue where empty VIRTUAL_ENV or CONDA_PREFIX environment variables (e.g., after conda deactivate) would cause Poetry to incorrectly detect an active virtualenv (#10784).
• Fix an issue where an incomprehensible error message was printed when .venv was a file instead of a directory (#10777).
• Fix an issue where HTTP Basic Authentication credentials could be corrupted during request preparation, causing authentication failures with long tokens (#10748).
• Fix an issue where poetry publish --no-interaction --build requested user interaction (#10769).
• Fix an issue where poetry init and poetry new created a deprecated project.license format (#10787).

Docs

• Clarify the differences between poetry install and poetry update (#10713).
• Clarify the section of fields in the pyproject.toml examples (#10753).
• Add a note about the different installation location when Python from the Microsoft Store is used (#10759).
• Fix the system requirements for Poetry (#10739).
• Fix the poetry cache clear example (#10749).
• Fix the link to pipx installation instructions (#10783).

poetry-core (2.3.2)

• Fix an issue where platform_release could not be parsed on Debian Trixie (#930).
• Fix an issue where using project.readme.text in the pyproject.toml file resulted in broken metadata (#914).
• Fix an issue where dependency groups were considered equal when their resolved dependencies were equal, even if the groups themselves were not (#919).
• Fix an issue where removing a dependency from a group that included another group resulted in other dependencies being added to the included group (#922).
• Fix an issue where PEP 735 include-group entries were lost when [tool.poetry.group] also defined include-groups for the same group (#924).
• Fix an issue where the union of <value> not in <marker> constraints was wrongly treated as always satisfied (#925).
• Fix an issue where a post release with a local version identifier was wrongly allowed by a > version constraint (#921).
• Fix an issue where a version with the local version identifier 0 was treated as equal to the corresponding public version (#920).
• Fix an issue where a != <version> constraint wrongly disallowed pre releases and post releases of the specified version (#929).
• Fix an issue where in and not in constraints were wrongly not allowed by specific compound constraints (#927).

Changed

• Allow dulwich>=1.0 (#10701).

poetry-core (2.3.1)

• Fix an issue where platform_release could not be parsed on Windows Server (#911).

Fixed

• Fix an issue where cached information about each package was always considered outdated (#10699).

Docs

• Document SHELL_VERBOSITY environment variable (#10678).

Added

• Add support for exporting pylock.toml files with poetry-plugin-export (#10677).
• Add support for specifying build constraints for dependencies (#10388).
• Add support for publishing artifacts whose version is determined dynamically by the build-backend (#10644).
• Add support for editable project plugins (#10661).
• Check requires-poetry before any other validation (#10593).
• Validate the content of project.readme when running poetry check (#10604).
• Add the option to clear all caches by making the cache name in poetry cache clear optional (#10627).
• Automatically update the cache for packages where the locked files differ from cached files (#10657).
• Suggest to clear the cache if running a command with --no-cache solves an issue (#10585).
• Propose poetry init when trying poetry new for an existing directory (#10563).
• Add support for poetry publish --skip-existing for new Nexus OSS versions (#10603).
• Show Poetry's own Python's path in poetry debug info (#10588).

Changed

• Drop support for Python 3.9 (#10634).
• Change the default of installer.re-resolve from true to false (#10622).
• PEP 735 dependency groups are considered in the lock file hash (#10621).
• Deprecate poetry.utils._compat.metadata, which is sometimes used in plugins, in favor of importlib.metadata (#10634).
• Improve managing free-threaded Python versions with poetry python (#10606).
• Prefer JSON API to HTML API in legacy repositories (#10672).
• When running poetry init, only add the readme field in the pyproject.toml if the readme file exists (#10679).
• Raise an error if no hash can be determined for any distribution link of a package (#10673).
• Require dulwich>=0.25.0 (#10674).

Fixed

• Fix an issue where poetry remove did not work for PEP 735 dependency groups with include-group items (#10587).
• Fix an issue where poetry remove caused dangling include-group references in PEP 735 dependency groups (#10590).
• Fix an issue where poetry add did not work for PEP 735 dependency groups with include-group items (#10636).
• Fix an issue where PEP 735 dependency groups were not considered in the lock file hash (#10621).
• Fix an issue where wrong markers were locked for a dependency that was required by several groups with different markers (#10613).
• Fix an issue where non-deterministic markers were created in a method used by poetry-plugin-export (#10667).
• Fix an issue where wrong wheels were chosen for installation in free-threaded Python environments if Poetry itself was not installed with free-threaded Python (#10614).
• Fix an issue where poetry publish used the metadata of the project instead of the metadata of the build artifact (#10624).
• Fix an issue where poetry env use just used another Python version instead of failing when the requested version was not supported by the project (#10685).
• Fix an issue where poetry env activate returned the wrong command for dash (#10696).
• Fix an issue where data-dir and python.installation-dir could not be set (#10595).
• Fix an issue where Python and pip executables were not correctly detected on Windows (#10645).
• Fix an issue where invalid template variables in virtualenvs.prompt caused an incomprehensible error message (#10648).

Docs

• Add a warning about ~/.netrc for Poetry credential configuration (#10630).
• Clarify that the local configuration takes precedence over the global configuration (#10676).
• Add an explanation in which cases packages are automatically detected (#10680).

poetry-core (2.3.0)

• Normalize versions (#893).
• Fix an issue where unsatisfiable requirements did not raise an error (#891).
• Fix an issue where the implicit main group did not exist if it was explicitly declared as not having any dependencies (#892).
• Fix an issue where python_full_version markers with pre-release versions were parsed incorrectly (#893).

Fixed

• Fix an issue where poetry self show failed with a message about an invalid output format (#10560).

Docs

• Remove outdated statements about dependency groups (#10561).

poetry-core (2.2.1)

• Fix an issue where it was not possible to declare a PEP 735 dependency group as optional (#888).

Added

• Add support for nesting dependency groups (#10166).
• Add support for PEP 735 dependency groups (#10130).
• Add support for PEP 639 license clarity (#10413).
• Add a --format option to poetry show to alternatively output json format (#10487).
• Add official support for Python 3.14 (#10514).

Changed

• Normalize dependency group names (#10387).
• Change installer.no-binary and installer.only-binary so that explicit package names will take precedence over :all: (#10278).
• Improve log output during poetry install when a wheel is built from source (#10404).
• Improve error message in case a file lock could not be acquired while cloning a git repository (#10535).
• Require dulwich>=0.24.0 (#10492).
• Allow virtualenv>=20.33 again (#10506).
• Allow findpython>=0.7 (#10510).
• Allow importlib-metadata>=8.7 (#10511).

Fixed

• Fix an issue where poetry new did not create the project structure in an existing empty directory (#10431).
• Fix an issue where a dependency that was required for a specific Python version was not installed into an environment of a pre-release Python version (#10516).

poetry-core (2.2.0)

• Deprecate table values and values that are not valid SPDX expressions for [project.license] (#870).
• Fix an issue where explicitly included files that are in .gitignore were not included in the distribution (#874).
• Fix an issue where marker operations could result in invalid markers (#875).

Changed

• Require virtualenv<20.33 to work around an issue where Poetry uses the wrong Python version (#10491).
• Improve the error messages for the validation of the pyproject.toml file (#10471).

Fixed

• Fix an issue where project plugins were installed even though poetry install was called with --no-plugins (#10405).
• Fix an issue where dependency resolution failed for self-referential extras with duplicate dependencies (#10488).

Docs

• Clarify how to include files that were automatically excluded via VCS ignore settings (#10442).
• Clarify the behavior of poetry add if no version constraint is explicitly specified (#10445).

Changed

• Require importlib-metadata<8.7 for Python 3.9 because of a breaking change in importlib-metadata 8.7 (#10374).

Fixed

• Fix an issue where re-locking failed for incomplete multiple-constraints dependencies with explicit sources (#10324).
• Fix an issue where the --directory option did not work if a plugin, which accesses the poetry instance during its activation, was installed (#10352).
• Fix an issue where poetry env activate -v printed additional information to stdout instead of stderr so that the output could not be used as designed (#10353).
• Fix an issue where the original error was not printed if building a git dependency failed (#10366).
• Fix an issue where wheels for the wrong platform were installed in rare cases. (#10361).

poetry-core (2.1.3)

• Fix an issue where the union of specific inverse or partially inverse markers was not simplified (#858).
• Fix an issue where optional dependencies defined in the project section were treated as non-optional when a source was defined for them in the tool.poetry section (#857).
• Fix an issue where markers with === were not parsed correctly (#860).
• Fix an issue where local versions with upper case letters caused an error (#859).
• Fix an issue where extra markers with a value starting with "in" were not validated correctly (#862).

Changed

• Improve performance of locking dependencies (#10275).

Fixed

• Fix an issue where markers were not locked correctly (#10240).
• Fix an issue where the result of poetry lock was not deterministic (#10276).
• Fix an issue where poetry env activate returned the wrong command for tcsh (#10243).
• Fix an issue where poetry env activate returned the wrong command for pwsh on Linux (#10256).

Docs

• Update basic usage section to reflect new default layout (#10203).

poetry-core (2.1.2)

• Improve performance of marker operations (#851).
• Fix an issue where incorrect markers were calculated when removing parts covered by the project's Python constraint (#841, #846).
• Fix an issue where extra markers were not simplified (#842, #845, #847).
• Fix an issue where the intersection and union of markers was not deterministic (#843).
• Fix an issue where the intersection of python_version markers was not recognized as empty (#849).
• Fix an issue where python_version markers were not simplified (#848, #851).
• Fix an issue where Python constraints on a package were converted into invalid markers (#853).

Fixed

• Fix an issue where poetry env use python does not choose the Python from the PATH (#10187).

poetry-core (2.1.1)

• Fix an issue where simplifying a python_version marker resulted in an invalid marker (#838).

Added

• Make build command build-system agnostic (#10059, #10092).
• Add a --config-settings option to poetry build (#10059).
• Add support for defining config-settings when building dependencies (#10129).
• Add (experimental) commands to manage Python installations (#10112).
• Use findpython to find the Python interpreters (#10097).
• Add a --no-truncate option to poetry show (#9580).
• Re-add support for passwords with empty usernames (#10088).
• Add better error messages (#10053, #10065, #10126, #10127, #10132).

Changed

• poetry new defaults to "src" layout by default (#10135).
• Improve performance of locking dependencies (#10111, #10114, #10138, #10146).
• Deprecate adding sources without specifying --priority (#10134).

Fixed

• Fix an issue where global options were not handled correctly when positioned after command options (#10021, #10067, #10128).
• Fix an issue where building a dependency from source failed because of a conflict between build-system dependencies that were not required for the target environment (#10048).
• Fix an issue where poetry init was not able to find a package on PyPI while adding dependencies interactively (#10055).
• Fix an issue where the @latest descriptor was incorrectly passed to the core requirement parser (#10069).
• Fix an issue where Boolean environment variables set to True (in contrast to true) were interpreted as false (#10080).
• Fix an issue where poetry env activate reported a misleading error message (#10087).
• Fix an issue where adding an optional dependency with poetry add --optional would not correctly update the lock file (#10076).
• Fix an issue where pip was not installed/updated before other dependencies resulting in a race condition (#10102).
• Fix an issue where Poetry freezes when multiple threads attempt to unlock the keyring simultaneously (#10062).
• Fix an issue where markers with extras were not locked correctly (#10119).
• Fix an issue where self-referential extras were not resolved correctly (#10106).
• Fix an issue where Poetry could not be run from a zipapp (#10074).
• Fix an issue where installation failed with a permission error when using the system environment as a user without write access to system site packages (#9014).
• Fix an issue where a version of a dependency that is not compatible with the project's python constraint was locked. (#10141).
• Fix an issue where Poetry wrongly reported that the current project's supported Python range is not compatible with some of the required packages Python requirement (#10157).
• Fix an issue where the requested extras of a dependency were ignored if the same dependency (with same extras) was specified in multiple groups (#10158).

Docs

• Sort commands by name in the CLI reference (#10035).
• Add missing documentation for env commands (#10027).
• Clarify that the name and version fields are always required if the project section is specified (#10033).
• Add a note about restarting the shell for tab completion changes to take effect (#10070).
• Fix the example for project.gui-scripts #10121.
• Explain how to include files as scripts in the project configuration (#9572, #10133).
• Add additional information on specifying required python versions (#10104).

poetry-core (2.1.0)

• Fix an issue where inclusive ordering with post releases was inconsistent with PEP 440 (#379).
• Fix an issue where invalid URI tokens in PEP 508 requirement strings were silently discarded (#817).
• Fix an issue where wrong markers were calculated when removing parts covered by the project's python constraint (#824).
• Fix an issue where optional dependencies that are not part of an extra were included in the wheel metadata (#830).
• Fix an issue where the __pycache__ directory and *.pyc files were included in sdists and wheels (#835).

Added

• Add support for poetry search in legacy sources (#9949).
• Add a message in the poetry source show output when PyPI is implicitly enabled (#9974).

Changed

• Improve performance for merging markers from overrides at the end of dependency resolution (#10018).

Fixed

• Fix an issue where poetry sync did not remove packages that were not requested (#9946).
• Fix an issue where poetry check failed even though there were just warnings and add a --strict option to fail on warnings (#9983).
• Fix an issue where poetry update, poetry add and poetry remove with --only uninstalled packages from other groups (#10014).
• Fix an issue where poetry update, poetry add and poetry remove uninstalled all extra packages (#10016).
• Fix an issue where poetry self update did not recognize Poetry's own environment (#9995).
• Fix an issue where read-only system site-packages were not considered when loading an environment with system site-packages (#9942).
• Fix an issue where an error message in poetry install started with Warning: instead of Error: (#9945).
• Fix an issue where Command.set_poetry, which is used by plugins, was removed (#9981).
• Fix an issue where the help text of poetry build --clean showed a malformed short option instead of the description (#9994).

Docs

• Add a FAQ entry for the migration from Poetry-specific fields to the project section (#9996).
• Fix examples for project.readme and project.urls (#9948).
• Add a warning that package sources are a Poetry-specific feature that is not included in core metadata (#9935).
• Replace poetry install --sync with poetry sync in the section about synchronizing dependencies (#9944).
• Replace poetry shell with poetry env activate in the basic usage section (#9963).
• Mention that project.name is always required when the project section is used (#9989).
• Fix the constraint of poetry-plugin-export in the section about poetry export (#9954).

poetry-core (2.0.1)

• Replace the deprecated core metadata field Home-page with Project-URL: Homepage (#807).
• Fix an issue where includes from tool.poetry.packages without a specified format were not initialized with the default value resulting in a KeyError (#805).
• Fix an issue where some project.urls entries were not processed correctly resulting in a KeyError (#807).
• Fix an issue where dynamic project.dependencies via tool.poetry.dependencies were ignored if project.optional-dependencies were defined (#811).

Added

• Add support for the project section in the pyproject.toml file according to PEP 621 (#9135, #9917).
• Add support for defining Poetry plugins that are required by the project and automatically installed if not present (#9547).
• Lock resulting markers and groups and add a installer.re-resolve option (default: true) to allow installation without re-resolving (#9427).
• Add a --local-version option to poetry build (#9064).
• Add a --clean option to poetry build (#9067).
• Add FIPS support for poetry publish (#9101).
• Add the option to use poetry new interactively and configure more fields (#9101).
• Add a config option installer.only-binary to enforce the use of binary distribution formats (#9150).
• Add support for poetry search in legacy sources (#9132).
• Add support to resume downloads from connection resets (#9422).
• Add the option to define a constraint for the required Poetry version to manage the project (#9547).
• Add an --all-groups option to poetry install (#9744).
• Add an poetry env activate command as replacement of poetry shell (#9763).
• Add a --markers option to poetry add to add a dependency with markers (#9814).
• Add a --migrate option to poetry config to migrate outdated configs (#9830).
• Add a --project option to search the pyproject.toml file in another directory without switching the directory (#9831).
• Add support for shortened hashes to define git dependencies (#9748).
• Add partial support for conflicting extras (#9553).
• Add a poetry sync command as replacement of poetry install --sync (#9801).

Changed

• Change the default behavior of poetry lock to --no-update and introduce a --regenerate option for the old default behavior (#9327).
• Remove the dependency on poetry-plugin-export so that poetry export is not included per default (#5980).
• Outsource poetry shell into poetry-plugin-shell (#9763).
• Change the interface of poetry add --optional to require an extra the optional dependency is added to (#9135).
• Actually switch the directory when using --directory/-C (#9831).
• Drop support for Python 3.8 (#9692).
• Rename experimental.system-git-client to experimental.system-git (#9787, #9795).
• Replace virtualenvs.prefer-active-python by the inverse setting virtualenvs.use-poetry-python and prefer the active Python by default (#9786).
• Deprecate several fields in the tool.poetry section in favor of the respective fields in the project section in the pyproject.toml file (#9135).
• Deprecate poetry install --sync in favor of poetry sync (#9801).
• Upgrade the warning if the current project cannot be installed to an error (#9333).
• Remove special handling for platformdirs 2.0 macOS config directory (#8916).
• Tweak PEP 517 builds (#9094).
• Use Poetry instead of pip to manage dependencies in isolated build environments (#9168, #9227).
• Trust empty Requires-Dist with modern metadata (#9078).
• Do PEP 517 builds instead of parsing setup.py to determine dependencies (#9099).
• Drop support for reading lock files prior version 1.0 (created with Poetry prior 1.1) (#9345).
• Default to >= instead of ^ for the Python requirement when initializing a new project (#9558).
• Limit build-system to the current major version of poetry-core when initializing a new project (#9812).
• Remove pip-based installation, i.e. installer.modern-installation = false (#9392).
• Remove virtualenvs.options.no-setuptools config option and never include setuptools per default (#9331).
• Rename exceptions to have an Error suffix (#9705).
• Remove deprecated CLI options and methods and revoke the deprecation of --dev (#9732).
• Ignore installed packages during dependency resolution (#9851).
• Improve the error message on upload failure (#9701).
• Improve the error message if the current project cannot be installed to include another root cause (#9651).
• Improve the output of poetry show <package> (#9750).
• Improve the error message for build errors (#9870).
• Improve the error message when trying to remove a package from a project without any dependencies (#9918).
• Drop the direct dependency on crashtest (#9108).
• Require keyring>=23.3.1 (#9167).
• Require build>=1.2.1 (#9283).
• Require dulwich>=0.22.6 (#9748).

Fixed

• Fix an issue where git dependencies with extras could only be cloned if a branch was specified explicitly (#7028).
• Fix an issue where poetry env remove failed if virtualenvs.in-project was set to true (#9118).
• Fix an issue where locking packages with a digit at the end of the name and non-standard sdist names failed (#9189).
• Fix an issue where credentials where not passed when trying to download an URL dependency (#9202).
• Fix an issue where using uncommon group names with poetry add resulted in a broken pyproject.toml (#9277).
• Fix an issue where an inconsistent entry regarding the patch version of Python was kept in envs.toml (#9286).
• Fix an issue where relative paths were not resolved properly when using poetry build --directory (#9433).
• Fix an issue where unrequested extras were not uninstalled when running poetry install without an existing lock file (#9345).
• Fix an issue where the poetry-check pre-commit hook did not trigger if only poetry.lock has changed (#9504).
• Fix an issue where files (rather than directories) could not be added as single page source (#9166).
• Fix an issue where invalid constraints were generated when adding a package with a local version specifier (#9603).
• Fix several encoding warnings (#8893).
• Fix an issue where virtualenvs.prefer-active-python was not respected (#9278).
• Fix an issue where the line endings of the lock file were changed (#9468).
• Fix an issue where installing multiple dependencies from the same git repository failed sporadically due to a race condition (#9658).
• Fix an issue where installing multiple dependencies from forked monorepos failed sporadically due to a race condition (#9723).
• Fix an issue where an extra package was not installed if it is required by multiple extras (#9700).
• Fix an issue where a direct_url.json with vcs URLs not compliant with PEP 610 was written (#9007).
• Fix an issue where other files than wheels were recognized as wheels (#9770).
• Fix an issue where installer.max-workers was ignored for the implicit PyPI source (#9815).
• Fix an issue where local settings (from poetry.toml) were ignored for the implicit PyPI source (#9816).
• Fix an issue where different dulwich versions resulted in different hashes for a git dependency from a tag (#9849).
• Fix an issue where installing a yanked package with no dependencies failed with an IndexError (#9505).
• Fix an issue where a package could not be added from a source that required an empty password (#9850).
• Fix an issue where setting allow-prereleases = false still allowed pre-releases if no other solution was found (#9798).
• Fix an issue where the wrong environment was used for checking if an installed package is from system site packages (#9861).
• Fix an issue where build errors from builds to retrieve metadata information were hidden (#9870).
• Fix an issue where poetry check falsely reported that an invalid source "pypi" is referenced in dependencies (#9475).
• Fix an issue where poetry install --sync tried to uninstall system site packages if the virtual environment was created with virtualenvs.options.system-site-packages = true (#9863).
• Fix an issue where HTTP streaming requests were not closed properly when not completely consumed (#9899).

Docs

• Add information about getting test coverage in the contribution guide (#9726).
• Mention pre-commit-autoupdate as an alternative to pre-commit autoupdate (#9716).
• Improve the explanation of exclude and include (#9734).
• Add information about compatible release requirements, i.e. ~= (#9783).
• Add documentation for using a build script to build extension modules (#9864).

poetry-core (2.0.0)

• Add support for non PEP440 compliant version in the platform_release marker (#722).
• Add support for string comparisons with in / not in in generic constraints (#722).
• Add support for script files that are generated by a build script (#710).
• Add support for SOURCE_DATE_EPOCH when building packages (#766, #781).
• Create METADATA files with version 2.3 instead of 2.2 (#707).
• Remove support for x in version constraints (#770).
• Remove support for scripts with extras (#708).
• Remove deprecated features and interfaces (#702, #769).
• Deprecate tool.poetry.dev-dependencies in favor of tool.poetry.group.dev.dependencies (#754).
• Fix an issue where the platlib directory of the wrong Python was used (#726).
• Fix an issue where building a wheel in a nested output directory results in an error (#762).
• Fix an issue where + was not allowed in git URL paths (#765).
• Fix an issue where the temporary directory was not cleaned up on error (#775).
• Fix an issue where the regular expression for author names was too restrictive (#517).
• Fix an issue where basic auth http(s) credentials could not be parsed (#791).

Changed

• Require pkginfo>=1.12 to fix an issue with an unknown metadata version 2.4 (#9888).
• Do not fail if the unknown metadata version is only a minor version update (#9888).

Added

• Add official support for Python 3.13 (#9523).

Changed

• Require virtualenv>=20.26.6 to mitigate potential command injection when running poetry shell in untrusted projects (#9757).

poetry-core (1.9.1)

• Add 3.13 to the list of available Python versions (#747).

Added

• Add support for untagged CPython builds with versions ending with a + (#9207).

Changed

• Require pkginfo>=1.10 to ensure support for packages with metadata version 2.3 (#9130).
• Improve locking on FIPS systems (#9152).

Fixed

• Fix an issue where unrecognized package metadata versions silently resulted in empty dependencies (#9203, #9226).
• Fix an issue where trailing slashes in git URLs where not handled correctly (#9205).
• Fix an issue where poetry self commands printed a warning that the current project cannot be installed (#9302).
• Fix an issue where poetry install sporadically failed with a KeyError due to a race condition (#9335).

Docs

• Fix incorrect information about poetry shell (#9060).
• Add a git subdirectory example to poetry add (#9080).
• Mention interactive credential configuration (#9074).
• Add notes for optional advanced installation steps (#9098).
• Add reference to configuration credentials in documentation of poetry publish (#9110).
• Improve documentation for configuring credentials via environment variables (#9121).
• Remove misleading wording around virtual environments (#9213).
• Remove outdated advice regarding seeding keyring backends (#9164).
• Add a pyproject.toml example for a dependency with multiple extras (#9138).
• Clarify help of poetry add (#9230).
• Add a note how to configure credentials for TestPyPI for poetry publish (#9255).
• Fix information about the --readme option in poetry new (#9260).
• Clarify what is special about the Python constraint in dependencies (#9256).
• Update how to uninstall plugins via pipx (#9320).

Fixed

• Harden lazy-wheel error handling if the index server is behaving badly in an unexpected way (#9051).
• Improve lazy-wheel error handling if the index server does not handle HTTP range requests correctly (#9082).
• Improve lazy-wheel error handling if the index server pretends to support HTTP range requests but does not respect them (#9084).
• Improve lazy-wheel to allow redirects for HEAD requests (#9087).
• Improve debug logging for lazy-wheel errors (#9059).
• Fix an issue where the hash of a metadata file could not be calculated correctly due to an encoding issue (#9048).
• Fix an issue where poetry add failed in non-package mode if no project name was set (#9046).
• Fix an issue where a hint to non-package mode was not compliant with the final name of the setting (#9073).

Fixed

• Update the minimum required version of packaging (#9031).
• Handle unexpected responses from servers that do not support HTTP range requests with negative offsets more robust (#9030).

Docs

• Rename master branch to main (#9022).

Added

• Add a non-package mode for use cases where Poetry is only used for dependency management (#8650).
• Add support for PEP 658 to fetch metadata without having to download wheels (#5509).
• Add a lazy-wheel config option (default: true) to reduce wheel downloads during dependency resolution (#8815, #8941).
• Improve performance of dependency resolution by using shallow copies instead of deep copies (#8671).
• poetry check validates that no unknown sources are referenced in dependencies (#8709).
• Add archive validation during installation for further hash algorithms (#8851).
• Add a to key in tool.poetry.packages to allow custom subpackage names (#8791).
• Add a config option to disable keyring (#8910).
• Add a --sync option to poetry update (#8931).
• Add an --output option to poetry build (#8828).
• Add a --dist-dir option to poetry publish (#8828).

Changed

• The implicit PyPI source is disabled if at least one primary source is configured (#8771).
• Deprecate source priority default (#8771).
• Upgrade the warning about an inconsistent lockfile to an error (#8737).
• Deprecate setting installer.modern-installation to false (#8988).
• Drop support for pip<19 (#8894).
• Require requests-toolbelt>=1 (#8680).
• Allow platformdirs 4.x (#8668).
• Allow and require xattr 1.x on macOS (#8801).
• Improve venv shell activation in fish (#8804).
• Rename system to base in output of poetry env info (#8832).
• Use pretty name in output of poetry version (#8849).
• Improve error handling for invalid entries in tool.poetry.scripts (#8898).
• Improve verbose output for dependencies with extras during dependency resolution (#8834).
• Improve message about an outdated lockfile (#8962).

Fixed

• Fix an issue where poetry shell failed when Python has been installed with MSYS2 (#8644).
• Fix an issue where Poetry commands failed in a terminal with a non-UTF-8 encoding (#8608).
• Fix an issue where a missing project name caused an incomprehensible error message (#8691).
• Fix an issue where Poetry failed to install an sdist path dependency (#8682).
• Fix an issue where poetry install failed because an unused extra was not available (#8548).
• Fix an issue where poetry install --sync did not remove an unrequested extra (#8621).
• Fix an issue where poetry init did not allow specific characters in the author field (#8779).
• Fix an issue where Poetry could not download sdists from misconfigured servers (#8701).
• Fix an issue where metadata of sdists that call CLI tools of their build requirements could not be determined (#8827).
• Fix an issue where Poetry failed to use the currently activated environment (#8831).
• Fix an issue where poetry shell failed in zsh if a space was in the venv path (#7245).
• Fix an issue where scripts with extras could not be installed (#8900).
• Fix an issue where explicit sources where not propagated correctly (#8835).
• Fix an issue where debug prints where swallowed when using a build script (#8760).
• Fix an issue where explicit sources of locked dependencies where not propagated correctly (#8948).
• Fix an issue where Poetry's own environment was falsely identified as system environment (#8970).
• Fix an issue where dependencies from a setup.py were ignored silently (#9000).
• Fix an issue where environment variables for virtualenv.options were ignored (#9015).
• Fix an issue where virtualenvs.options.no-pip and virtualenvs.options.no-setuptools were not normalized (#9015).

Docs

• Replace deprecated --no-dev with --without dev in the FAQ (#8659).
• Recommend poetry-check instead of the deprecated poetry-lock pre-commit hook (#8675).
• Clarify the names of the environment variables to provide credentials for repositories (#8782).
• Add note how to install several version of Poetry in parallel (#8814).
• Improve description of poetry show --why (#8817).
• Improve documentation of poetry update (#8706).
• Add a warning about passing variables that may start with a hyphen via command line (#8850).
• Mention that the virtual environment in which Poetry itself is installed should not be activated (#8833).
• Add note about poetry run and externally managed environments (#8748).
• Update FAQ entry about tox for tox 4.x (#8658).
• Fix documentation for default format option for include and exclude value (#8852).
• Add note about tox and configured credentials (#8888).
• Add note and link how to install pipx (#8878).
• Fix examples for poetry add with git dependencies over ssh (#8911).
• Remove reference to deprecated scripts extras feature (#8903).
• Change examples to prefer --only main instead of --without dev (#8921).
• Mention that the develop attribute is a Poetry-specific feature and not propagated to other tools (#8971).
• Fix examples for adding supplemental and secondary sources (#8953).
• Add PyTorch example for explicit sources (#9006).

poetry-core (1.9.0)

• Deprecate scripts that depend on extras (#690).
• Add support for path dependencies that do not define a build system (#675).
• Update list of supported licenses (#659, #669, #678, #694).
• Rework list of files included in build artifacts (#666).
• Fix an issue where insignificant errors were printed if the working directory is not inside a git repository (#684).
• Fix an issue where the project's directory was not recognized as git repository on Windows due to an encoding issue (#685).

Fixed

• Fix an issue where sdists that call CLI tools of their build requirements could not be installed (#8630).
• Fix an issue where sdists with symlinks could not be installed due to a broken tarfile datafilter (#8649).
• Fix an issue where poetry init failed when trying to add dependencies (#8655).
• Fix an issue where poetry install failed if virtualenvs.create was set to false (#8672).

Added

• Add official support for Python 3.12 (#7803, #8544).
• Print a future warning that poetry-plugin-export will not be installed by default anymore (#8562).
• Add poetry-install pre-commit hook (#8327).
• Add --next-phase option to poetry version (#8089).
• Print a warning when overwriting files from another package at installation (#8386).
• Print a warning if the current project cannot be installed (#8369).
• Report more details on build backend exceptions (#8464).

Changed

• Set Poetry as user-agent for all HTTP requests (#8394).
• Do not install setuptools per default in Python 3.12 (#7803).
• Do not install wheel per default (#7803).
• Remove setuptools and wheel when running poetry install --sync if they are not required by the project (#8600).
• Improve error message about PEP-517 support (#8463).
• Improve keyring handling (#8227).
• Read the description field when extracting metadata from setup.py files (#8545).

Fixed

• Fix an issue where dependencies of inactive extras were locked and installed (#8399).
• Fix an issue where build requirements were not installed due to a race condition in the artifact cache (#8517).
• Fix an issue where packages included in the system site packages were installed even though virtualenvs.options.system-site-packages was set (#8359).
• Fix an issue where git dependencies' submodules with relative URLs were handled incorrectly (#8020).
• Fix an issue where a failed installation of build dependencies was not noticed directly (#8479).
• Fix an issue where poetry shell did not work completely with nushell (#8478).
• Fix an issue where a confusing error messages was displayed when running poetry config pypi-token.pypi without a value (#8502).
• Fix an issue where a cryptic error message is printed if there is no metadata entry in the lockfile (#8523).
• Fix an issue with the encoding with special characters in the virtualenv's path (#8565).
• Fix an issue where the connection pool size was not adjusted to the number of workers (#8559).

Docs

• Improve the wording regarding a project's supported Python range (#8423).
• Make pipx the preferred (first mentioned) installation method (#8090).
• Add a warning about poetry self on Windows (#8090).
• Fix example for poetry add with a git dependency (#8438).
• Add information about auto-included files in wheels and sdist (#8555).
• Fix documentation of the POETRY_REPOSITORIES_ variables docs (#8492).
• Add CITATION.cff file (#8510).

poetry-core (1.8.1)

• Add support for creating packages dynamically in the build script (#629).
• Improve marker logic for extra markers (#636).
• Update list of supported licenses (#635, #646).
• Fix an issue where projects with extension modules were not installed in editable mode (#633).
• Fix an issue where the wrong or no lib folder was added to the wheel (#634).

poetry-plugin-export (^1.6.0)

• Add an --all-extras option (#241).
• Fix an issue where git dependencies are exported with the branch name instead of the resolved commit hash (#213).

Fixed

• Update the minimum required version of requests (#8336).

Added

• Add support for repositories that do not provide a supported hash algorithm (#8118).
• Add full support for duplicate dependencies with overlapping markers (#7257).
• Improve performance of poetry lock for certain edge cases (#8256).
• Improve performance of poetry install (#8031).
• poetry check validates that specified readme files do exist (#7444).
• Add a downgrading note when updating to an older version (#8176).
• Add support for vox in the xonsh shell (#8203).
• Add support for pre-commit hooks for projects where the pyproject.toml file is located in a subfolder (#8204).
• Add support for the git+http:// scheme (#6619).

Changed

• Drop support for Python 3.7 (#7674).
• Move poetry lock --check to poetry check --lock and deprecate the former (#8015).
• Change future warning that PyPI will only be disabled automatically if there are no primary sources (#8151).

Fixed

• Fix an issue where build-system.requires were not respected for projects with build scripts (#7975).
• Fix an issue where the encoding was not handled correctly when calling a subprocess (#8060).
• Fix an issue where poetry show --top-level did not show top level dependencies with extras (#8076).
• Fix an issue where poetry init handled projects with src layout incorrectly (#8218).
• Fix an issue where Poetry wrote .pth files with the wrong encoding (#8041).
• Fix an issue where poetry install did not respect the source if the same version of a package has been locked from different sources (#8304).

Docs

• Document official Poetry badge (#8066).
• Update configuration folder path for macOS (#8062).
• Add a warning about pip ignoring lock files (#8117).
• Clarify the use of the virtualenvs.in-project setting. (#8126).
• Change pre-commit YAML style to be consistent with pre-commit's own examples (#8146).
• Fix command for listing installed plugins (#8200).
• Mention the nox-poetry package (#8173).
• Add an example with a PyPI source in the pyproject.toml file (#8171).
• Use reference instead of deprecated callable in the scripts example (#8211).

poetry-core (1.7.0)

• Improve performance of marker handling (#609).
• Allow | as a value separator in markers with the operators in and not in (#608).
• Put pretty name (instead of normalized name) in metadata (#620).
• Update list of supported licenses (#623).
• Fix an issue where PEP 508 dependency specifications with names starting with a digit could not be parsed (#607).
• Fix an issue where Poetry considered an unrelated .gitignore file resulting in an empty wheel (#611).

poetry-plugin-export (^1.5.0)

• Fix an issue where markers for dependencies required by an extra were not generated correctly (#209).

Added

• Improve dependency resolution performance in cases with a lot of backtracking (#7950).

Changed

• Disable wheel content validation during installation (#7987).

Fixed

• Fix an issue where partially downloaded wheels were cached (#7968).
• Fix an issue where poetry run did no longer execute relative-path scripts (#7963).
• Fix an issue where dependencies were not installed in in-project environments (#7977).
• Fix an issue where no solution was found for a transitive dependency on a pre-release of a package (#7978).
• Fix an issue where cached repository packages were incorrectly parsed, leading to its dependencies being ignored (#7995).
• Fix an issue where an explicit source was ignored so that a direct origin dependency was used instead (#7973).
• Fix an issue where the installation of big wheels consumed a lot of memory (#7987).

Docs

• Add information about multiple constraints dependencies with direct origin and version dependencies (#7973).

poetry-core (1.6.1)

• Fix an endless recursion in marker handling (#593).
• Fix an issue where the wheel tag was not built correctly under certain circumstances (#591).

poetry-plugin-export (^1.4.0)

• Fix an issue where --extra-index-url and --trusted-host was not generated for sources with priority explicit (#205).

Added

• Introduce the new source priorities explicit and supplemental (#7658, #6879).
• Introduce the option to configure the priority of the implicit PyPI source (#7801).
• Add handling for corrupt cache files (#7453).
• Improve caching of URL and git dependencies (#7693, #7473).
• Add option to skip installing directory dependencies (#6845, #7923).
• Add --executable option to poetry env info (#7547).
• Add --top-level option to poetry show (#7415).
• Add --lock option to poetry remove (#7917).
• Add experimental POETRY_REQUESTS_TIMEOUT option (#7081).
• Improve performance of wheel inspection by avoiding unnecessary file copy operations (#7916).

Changed

• Remove the old deprecated installer and the corresponding setting experimental.new-installer (#7356).
• Introduce priority key for sources and deprecate flags default and secondary (#7658).
• Deprecate poetry run <entry point> if the entry point was not previously installed via poetry install (#7606).
• Only write the lock file if the installation succeeds (#7498).
• Do not write the unused package category into the lock file (#7637).

Fixed

• Fix an issue where Poetry's internal pyproject.toml continually grows larger with empty lines (#7705).
• Fix an issue where Poetry crashes due to corrupt cache files (#7453).
• Fix an issue where the Retry-After in HTTP responses was not respected and retries were handled inconsistently (#7072).
• Fix an issue where Poetry silently ignored invalid groups (#7529).
• Fix an issue where Poetry does not find a compatible Python version if not given explicitly (#7771).
• Fix an issue where the direct_url.json of an editable install from a git dependency was invalid (#7473).
• Fix an issue where error messages from build backends were not decoded correctly (#7781).
• Fix an infinite loop when adding certain dependencies (#7405).
• Fix an issue where pre-commit hooks skip pyproject.toml files in subdirectories (#7239).
• Fix an issue where pre-commit hooks do not use the expected Python version (#6989).
• Fix an issue where an unclear error message is printed if the project name is the same as one of its dependencies (#7757).
• Fix an issue where poetry install returns a zero exit status even though the build script failed (#7812).
• Fix an issue where an existing .venv was not used if in-project was not set (#7792).
• Fix an issue where multiple extras passed to poetry add were not parsed correctly (#7836).
• Fix an issue where poetry shell did not send a newline to fish (#7884).
• Fix an issue where poetry update --lock printed operations that were not executed (#7915).
• Fix an issue where poetry add --lock did perform a full update of all dependencies (#7920).
• Fix an issue where poetry shell did not work with nushell (#7919).
• Fix an issue where subprocess calls failed on Python 3.7 (#7932).
• Fix an issue where keyring was called even though the password was stored in an environment variable (#7928).

Docs

• Add information about what to use instead of --dev (#7647).
• Promote semantic versioning less aggressively (#7517).
• Explain Poetry's own versioning scheme in the FAQ (#7517).
• Update documentation for configuration with environment variables (#6711).
• Add details how to disable the virtualenv prompt (#7874).
• Improve documentation on whether to commit poetry.lock (#7506).
• Improve documentation of virtualenv.create (#7608).

poetry-core (1.6.0)

• Improve error message for invalid markers (#569).
• Increase robustness when deleting temporary directories on Windows (#460).
• Replace tomlkit with tomli, which changes the interface of some internal classes (#483).
• Deprecate Package.category (#561).
• Fix a performance regression in marker handling (#568).
• Fix an issue where wildcard version constraints were not handled correctly (#402).
• Fix an issue where poetry build created duplicate Python classifiers if they were specified manually (#578).
• Fix an issue where local versions where not handled correctly (#579).

Changed

• When trying to install wheels with invalid RECORD files, Poetry does not fail anymore but only prints a warning. This mitigates an unintended change introduced in Poetry 1.4.1 (#7694).

Fixed

• Fix an issue where relative git submodule urls were not parsed correctly (#7017).
• Fix an issue where Poetry could freeze when building a project with a build script if it generated enough output to fill the OS pipe buffer (#7699).

Fixed

• Fix an issue where poetry install did not respect the requirements for building editable dependencies (#7579).
• Fix an issue where poetry init crashed due to bad input when adding packages interactively (#7569).
• Fix an issue where poetry install ignored the subdirectory argument of git dependencies (#7580).
• Fix an issue where installing packages with no-binary could result in a false hash mismatch (#7594).
• Fix an issue where the hash of sdists was neither validated nor written to the direct_url.json during installation (#7594).
• Fix an issue where poetry install --sync attempted to remove itself (#7626).
• Fix an issue where wheels with non-normalized dist-info directory names could not be installed (#7671).
• Fix an issue where poetry install --compile compiled with optimization level 1 (#7666).

Docs

• Clarify the behavior of the --extras option (#7563).
• Expand the FAQ on reasons for slow dependency resolution (#7620).

Added

• Add a modern installer (installer.modern-installation) for faster installation of packages and independence from pip (#6205).
• Add support for Private :: trove classifiers (#7271).
• Add the version of poetry in the @generated comment at the beginning of the lock file (#7339).
• Add support for virtualenvs.prefer-active-python when running poetry new and poetry init (#7100).

Changed

• Deprecate the old installer, i.e. setting experimental.new-installer to false (#7358).
• Remove unused platform field from cached package info and bump the cache version (#7304).
• Extra dependencies of the root project are now sorted in the lock file (#7375).
• Remove upper boundary for importlib-metadata dependency (#7434).
• Validate path dependencies during use instead of during construction (#6844).
• Remove the deprecated repository modules (#7468).

Fixed

• Fix an issue where an unconditional dependency of an extra was not installed in specific environments (#7175).
• Fix an issue where a pre-release of a dependency was chosen even if a stable release fulfilled the constraint (#7225, #7236).
• Fix an issue where HTTP redirects were not handled correctly during publishing (#7160).
• Fix an issue where poetry check did not handle the -C, --directory option correctly (#7241).
• Fix an issue where the subdirectory information of a git dependency was not written to the lock file (#7367).
• Fix an issue where the wrong Python version was selected when creating an virtual environment (#7221).
• Fix an issue where packages that should be kept were uninstalled when calling poetry install --sync (#7389).
• Fix an issue where an incorrect value was set for sys.argv[0] when running installed scripts (#6737).
• Fix an issue where hashes in direct_url.json files were not written according to the specification (#7475).
• Fix an issue where poetry commands failed due to special characters in the path of the project or virtual environment (#7471).
• Fix an issue where poetry crashed with a JSONDecodeError when running a Python script that produced certain warnings (#6665).

Docs

• Add advice on how to maintain a poetry plugin (#6977).
• Update tox examples to comply with the latest tox release (#7341).
• Mention that the poetry export can export constraints.txt files (#7383).
• Add clarifications for moving configuration files (#6864).
• Mention the different types of exact version specifications (#7503).

poetry-core (1.5.1)

• Improve marker handling (#528, #534, #530, #546, #547).
• Validate whether dependencies referenced in extras are defined in the main dependency group (#542).
• Poetry no longer generates a setup.py file in sdists by default (#318).
• Fix an issue where trailing newlines were allowed in tool.poetry.description (#505).
• Fix an issue where the name of the data folder in wheels was not normalized (#532).
• Fix an issue where the order of entries in the RECORD file was not deterministic (#545).
• Fix an issue where zero padding was not correctly handled in version comparisons (#540).
• Fix an issue where sdist builds did not support multiple READMEs (#486).

poetry-plugin-export (^1.3.0)

• Fix an issue where the export failed if there was a circular dependency on the root package (#118).

Fixed

• Fix a performance regression when locking dependencies from PyPI (#7232).
• Fix an issue where passing a relative path via -C, --directory fails (#7266).

Docs

• Update docs to reflect the removal of the deprecated get-poetry.py installer from the repository (#7288).
• Add clarifications for virtualenvs.path settings (#7286).

Fixed

• Fix an issue where an explicit dependency on lockfile was missing, resulting in a broken Poetry in rare circumstances (7169).

Added

• Mark the lock file with an @generated comment as used by common tooling (#2773).
• poetry check validates trove classifiers and warns for deprecations (#2881).
• Introduce a top level -C, --directory option to set the working path (#6810).

Changed

• New lock file format (version 2.0) (#6393).
• Path dependency metadata is unconditionally re-locked (#6843).
• URL dependency hashes are locked (#7121).
• poetry update and poetry lock should now resolve dependencies more similarly (#6477).
• poetry publish will report more useful errors when a file does not exist (#4417).
• poetry add will check for duplicate entries using canonical names (#6832).
• Wheels are preferred to source distributions when gathering metadata (#6547).
• Git dependencies of extras are only fetched if the extra is requested (#6615).
• Invoke pip with --no-input to prevent hanging without feedback (#6724, #6966).
• Invoke pip with --isolated to prevent the influence of user configuration (#6531).
• Interrogate environments with Python in isolated (-I) mode (#6628).
• Raise an informative error when multiple version constraints overlap and are incompatible (#7098).

Fixed

• Fix an issue where concurrent instances of Poetry would corrupt the artifact cache (#6186).
• Fix an issue where Poetry can hang after being interrupted due to stale locking in cache (#6471).
• Fix an issue where the output of commands executed with --dry-run contained duplicate entries (#4660).
• Fix an issue where requests's pool size did not match the number of installer workers (#6805).
• Fix an issue where poetry show --outdated failed with a runtime error related to direct origin dependencies (#6016).
• Fix an issue where only the last command of an ApplicationPlugin is registered (#6304).
• Fix an issue where git dependencies were fetched unnecessarily when running poetry lock --no-update (#6131).
• Fix an issue where stdout was polluted with messages that should go to stderr (#6429).
• Fix an issue with poetry shell activation and zsh (#5795).
• Fix an issue where a url dependencies were shown as outdated (#6396).
• Fix an issue where the source field of a dependency with extras was ignored (#6472).
• Fix an issue where a package from the wrong source was installed for a multiple-constraints dependency with different sources (#6747).
• Fix an issue where dependencies from different sources where merged during dependency resolution (#6679).
• Fix an issue where experimental.system-git-client could not be used via environment variable (#6783).
• Fix an issue where Poetry fails with an AssertionError due to distribution.files being None (#6788).
• Fix an issue where poetry env info did not respect virtualenvs.prefer-active-python (#6986).
• Fix an issue where poetry env list does not list the in-project environment (#6979).
• Fix an issue where poetry env remove removed the wrong environment (#6195).
• Fix an issue where the return code of a script was not relayed as exit code (#6824).
• Fix an issue where the solver could silently swallow ValueError (#6790).

Docs

• Improve documentation of package sources (#5605).
• Correct the default cache path on Windows (#7012).

poetry-core (1.4.0)

• The PEP 517 metadata_directory is now respected as an input to the build_wheel hook (#487).
• ParseConstraintError is now raised on version and constraint parsing errors, and includes information on the package that caused the error (#514).
• Fix an issue where invalid PEP 508 requirements were generated due to a missing space before semicolons (#510).
• Fix an issue where relative paths were encoded into package requirements, instead of a file:// URL as required by PEP 508 (#512).

poetry-plugin-export (^1.2.0)

• Ensure compatibility with Poetry 1.3.0. No functional changes.

cleo (^2.0.0)

• Fix an issue where shell completions had syntax errors (#247).
• Fix an issue where not reading all the output of a command resulted in a "Broken pipe" error (#165).
• Fix an issue where errors were not shown in non-verbose mode (#166).

Added

• Add forward compatibility for lock file format 2.0, which will be used by Poetry 1.3 (#6608).

Changed

• Allow poetry lock to re-generate the lock file when invalid or incompatible (#6753).

Fixed

• Fix an issue where the deprecated JSON API was used to query PyPI for available versions of a package (#6081).
• Fix an issue where versions were escaped wrongly when building the wheel name (#6476).
• Fix an issue where the installation of dependencies failed if pip is a dependency and is updated in parallel to other dependencies (#6582).
• Fix an issue where the names of extras were not normalized according to PEP 685 (#6541).
• Fix an issue where sdist names were not normalized (#6621).
• Fix an issue where invalid constraints, which are ignored, were only reported in a debug message instead of a warning (#6730).
• Fix an issue where poetry shell was broken in git bash on Windows (#6560).

Docs

• Rework the README and contribution docs (#6552).
• Fix for inconsistent docs for multiple-constraint dependencies (#6604).
• Rephrase plugin configuration (#6557).
• Add a note about publishable repositories to publish (#6641).
• Fix the path for lazy-loaded bash completion (#6656).
• Fix a reference to the invalid option --require (#6672).
• Add a PowerShell one-liner to the basic usage section (#6683).
• Fix the minimum poetry version in the example for plugins (#6739).

poetry-core (1.3.2)

• Add 3.11 to the list of available Python versions (#477).
• Fix an issue where caret constraints of pre-releases with a major version of 0 resulted in an empty version range (#475).

poetry-plugin-export (^1.1.2)

• Add support for exporting constraints.txt files (#128).
• Fix an issue where a relative path passed via -o was not interpreted relative to the current working directory (#130).

Changed

• Bump poetry-core to 1.2.0.
• Bump poetry-plugin-export to ^1.0.7.

Fixed

• Fix an issue where poetry cache clear did not respect the -n/--no-interaction flag (#6338).
• Fix an issue where poetry lock --no-update updated dependencies from non-PyPI package sources (#6335).
• Fix a poetry install performance regression by falling back to internal pip (#6062).
• Fix an issue where a virtual environment was created unnecessarily when running poetry export (#6282).
• Fix an issue where poetry lock --no-update added duplicate hashes to the lock file (#6389).
• Fix an issue where poetry install fails because of missing hashes for url dependencies (#6389).
• Fix an issue where Poetry was not able to update pip in Windows virtual environments (#6430).
• Fix an issue where Poetry was not able to install releases that contained less common link types (#5767).
• Fix a poetry lock performance regression when checking non-PyPI sources for yanked versions (#6442).
• Fix an issue where --no-cache was not respected when running poetry install (#6479).
• Fix an issue where deprecation warnings for --dev were missing (#6475).
• Fix an issue where Git dependencies failed to clone when insteadOf was used in .gitconfig using the Dulwich Git client (#6506).
• Fix an issue where no cache entry is found when calling poetry cache clear with a non-normalized package name (#6537).
• Fix an invalid virtualenv constraint on Poetry (#6402).
• Fix outdated build system requirements for Poetry (#6509).

Docs

• Add missing path segment to paths used by install.python-poetry.org (#6311).
• Add recommendations about how to install Poetry in a CI environment (#6345).
• Fix examples for --with and --without (#6318).
• Update configuration folder path for macOS (#6395).
• Improve the description of the virtualenv.create option (#6460).
• Clarify that poetry install removes dependencies of non-installed extras (#6229).
• Add a note about pre-commit autoupdate and Poetry's hooks (#6497).

Note that this release makes the new install format (and thus new installer or an alternative supported install method) a hard requirement.

If you are currently installing using the deprecated get-poetry.py, you will be unable to install Poetry 1.2. Additionally, Poetry 1.1 installed using get-poetry.py will be not be able to update using poetry self update.

See the 1.2.0 release announcement for a summary of how to migrate to install.python-poetry.org if you fall into one of these two cases.

Docs

• Added note about how to add a git dependency with a subdirectory (#6218)
• Fixed several style issues in the docs (#6255)
• Fixed outdated info about --only parameter (#6264)

Fixed

• Fixed an issue where virtual environments were created unnecessarily when running poetry self commands (#6226)
• Ensure that packages' pretty_name are written to the lock file (#6243)

Improvements

• Improved the consistency of Pool().remove_repository() to make it easier to write poetry plugins (#6231)

Docs

• Removed mentions of Python 2.7 from docs (#6235)
• Added note about the difference between groups and extras (#6232)

Added

• Added support for subdirectories in git dependencies (#5172)
• Added support for yanked releases and files (PEP-592) (#5841)
• Virtual environments can now be created even with empty project names (#5856)
• Added support for nushell in poetry shell (#6063)

Changed

• Poetry now falls back to gather metadata for dependencies via pep517 if parsing pyproject.toml fails (#5834)
• Replaced Poetry's helper method canonicalize_name() with packaging.utils.canonicalize_name() (#6022)
• Removed code for the export command, which is now provided via plugin (#6128)
• Extras and extras dependencies are now sorted in the lock file (#6169)
• Removed deprecated (1.2-only) CLI options (#6210)

Fixed

• Fixed an issue where symlinks in the lock file were not resolved (#5850)
• Fixed a tomlkit regression resulting in inconsistent line endings (#5870)
• Fixed an issue where the POETRY_PYPI_TOKEN_PYPI environment variable wasn't respected (#5911)
• Fixed an issue where neither Python nor a managed venv can be found, when using Python from MS Store (#5931)
• Improved error message of poetry publish in the event of an upload error (#6043)
• Fixed an issue where poetry lock fails without output (#6058)
• Fixed an issue where Windows drive mappings break virtual environment names (#6110)
• tomlkit versions with memory leak are now avoided (#6160)
• Fixed an infinite loop in the solver (#6178)
• Fixed an issue where latest version was used instead of locked one for vcs dependencies with extras (#6185)

Docs

• Document use of the subdirectory parameter (#5949)
• Document suggested tox config for different use cases (#6026)

Important: This release fixes a critical issue that prevented hashes from being retrieved when locking dependencies, due to a breaking change on PyPI JSON API (see #5972 and the upstream change for more details).

After upgrading, you have to clear Poetry cache manually to get that feature working correctly again:

$ poetry cache clear pypi --all

Added

• Added --only-root to poetry install to install a project without its dependencies (#5783)

Changed

• Improved user experience of poetry init (#5838)
• Added default timeout for all HTTP requests, to avoid hanging requests (#5881)
• Updated poetry init to better specify how to skip adding dependencies (#5946)
• Updated Poetry repository names to avoid clashes with user-defined repositories (#5910)

Fixed

• Fixed an issue where extras where not handled if they did not match the case-sensitive name of the packages (#4122)
• Fixed configuration of experimental.system-git-client option through poetry config (#5818)
• Fixed uninstallation of git dependencies on Windows (#5836)
• Fixed an issue where ~ was not correctly expanded in virtualenvs.path (#5848)
• Fixed an issue where installing/locking dependencies would hang when setting an incorrect git repository (#5880)
• Fixed an issue in poetry publish when keyring was not properly configured (#5889)
• Fixed duplicated line output in console (#5890)
• Fixed an issue where the same wheels where downloaded multiple times during installation (#5871)
• Fixed an issue where dependencies hashes could not be retrieved when locking due to a breaking change on PyPI JSON API (#5973)
• Fixed an issue where a dependency with non-requested extras could not be installed if it is requested with extras by another dependency (#5770)
• Updated git backend to correctly read local/global git config when using dulwich as a git backend (#5935)
• Fixed an issue where optional dependencies where not correctly exported when defining groups (#5819)

Docs

• Fixed configuration instructions for repositories specification (#5809)
• Added a link to dependency specification from pyproject.toml (#5815)
• Improved zsh autocompletion instructions (#5859)
• Improved installation and update documentations (#5857)
• Improved exact requirements documentation (#5874)
• Added documentation for @ operator (#5822)
• Improved autocompletion documentation (#5879)
• Improved scripts definition documentation (#5884)

Added

• Added support for multiple-constraint direct origin dependencies with the same version (#5715)
• Added support disabling TLS verification for custom package sources via poetry config certificates.<repository>.cert false (#5719
• Added new configuration (virtualenvs.prompt) to customize the prompt of the Poetry-managed virtual environment (#5606)
• Added progress indicator to download_file (used when downloading dists) (#5451)
• Added --dry-run to poetry version command (#5603)
• Added --why to poetry show (#5444)
• Added support for single page (html) repositories (#5517)
• Added support for PEP 508 strings when adding dependencies via poetry add command (#5554)
• Added --no-cache as a global option (#5519)
• Added cert retrieval for HTTP requests made by Poetry (#5320)
• Added --skip-existing to poetry publish (#2812)
• Added --all-extras to poetry install (#5452)
• Added new poetry self sub-commands to manage plugins and/or system environment packages, eg: keyring backends (#5450)
• Added new configuration (installer.no-binary) to allow selection of non-binary distributions when installing a dependency (#5609)

Changed

• poetry plugin commands are now deprecated in favor of the more generic poetry self commands (#5450)
• When creating new projects, Poetry no longer restricts README extensions to md and rst (#5357)
• Changed the provider to allow fallback to installed packages (#5704)
• Solver now correctly handles and prefers direct reference constraints (vcs, file etc.) over public version identifiers (#5654)
• Changed the build script behavior to create an ephemeral build environment when a build script is specified (#5401)
• Improved performance when determining PEP 517 metadata from sources (#5601)
• Project package sources no longer need to be redefined as global repositories when configuring credentials (#5563)
• Replaced external git command use with dulwich, in order to force the legacy behaviour set experimental.system-git-client configuration to true (#5428)
• Improved http request handling for sources and multiple paths on same netloc (#5518)
• Made no-pip and no-setuptools configuration explicit (#5455)
• Improved application logging, use of -vv now provides more debug information (#5503)
• Renamed implicit group default to main (#5465)
• Replaced in-tree implementation of poetry export with poetry-plugin-export (#5413)
• Changed the password manager behavior to use a "null" keyring when disabled (#5251)
• Incremental improvement of Solver performance (#5335)
• Newly created virtual environments on macOS now are excluded from Time Machine backups (#4599)
• Poetry no longer raises an exception when a package is not found on PyPI (#5698)
• Update packaging dependency to use major version 21, this change forces Poetry to drop support for managing Python 2.7 environments (#4749)

Fixed

• Fixed poetry update --dry-run to not modify poetry.lock (#5718, #3666, #3766)
• Fixed #5537 where export fails to resolve dependencies with more than one path (#5688)
• Fixed an issue where the environment variables POETRY_CONFIG_DIR and POETRY_CACHE_DIR were not being respected (#5672)
• Fixed #3628 and #4702 by handling invalid distributions gracefully (#5645)
• Fixed an issue where the provider ignored subdirectory when merging and improve subdirectory support for vcs deps (#5648)
• Fixed an issue where users could not select an empty choice when selecting dependencies (#4606)
• Fixed an issue where poetry init -n crashes in a root directory (#5612)
• Fixed an issue where Solver errors arise due to wheels having different Python constraints (#5616)
• Fixed an issue where editable path dependencies using setuptools could not be correctly installed (#5590)
• Fixed flicker when displaying executor operations (#5556)
• Fixed an issue where the poetry lock --no-update only sorted by name and not by name and version (#5446)
• Fixed an issue where the Solver fails when a dependency has multiple constrained dependency definitions for the same package (#5403)
• Fixed an issue where dependency resolution takes a while because Poetry checks all possible combinations even markers are mutually exclusive (#4695)
• Fixed incorrect version selector constraint (#5500)
• Fixed an issue where poetry lock --no-update dropped packages (#5435)
• Fixed an issue where packages were incorrectly grouped when exporting (#5156)
• Fixed an issue where lockfile always updates when using private sources (#5362)
• Fixed an issue where the solver did not account for selected package features (#5305)
• Fixed an issue with console script execution of editable dependencies on Windows (#3339)
• Fixed an issue where editable builder did not write PEP-610 metadata (#5703)
• Fixed an issue where Poetry 1.1 lock files were incorrectly identified as not fresh (#5458)

Docs

• Updated plugin management commands (#5450)
• Added the --readme flag to documentation (#5357)
• Added example for multiple maintainers (#5661)
• Updated documentation for issues #4800, #3709, #3573, #2211 and #2414 (#5656)
• Added poetry.toml note in configuration (#5492)
• Add documentation for poetry about, poetry help, poetrylist, and the --full-path and --all options documentation (#5664)
• Added more clarification to the --why flag (#5653)
• Updated documentation to refer to PowerShell for Windows, including instructions (#3978, #5618)
• Added PEP 508 name requirement (#5642)
• Added example for each section of pyproject.toml (#5585)
• Added documentation for --local to fix issue #5623 (#5629)
• Added troubleshooting documentation for using proper quotation with ZSH (#4847)
• Added information on git and basic http auth (#5578)
• Removed ambiguity about PEP 440 and semver (#5576)
• Removed Pipenv comparison (#5561)
• Improved dependency group related documentation (#5338)
• Added documentation for default directories used by Poetry (#5391)
• Added warning about credentials preserved in shell history (#5726)
• Improved documentation of the readme option, including multiple files and additional formats (#5158)
• Improved contributing documentation (#5708)
• Remove all references to --dev-only option (#5771)

Fixed

• Fixed an issue where the system environment couldn't be detected (#4406).
• Fixed another issue where the system environment couldn't be detected (#4433).
• Replace deprecated requests parameter in uploader (#4580).
• Fix an issue where venv are detected as broken when using MSys2 on windows (#4482).
• Fixed an issue where the cache breaks on windows (#4531).
• Fixed an issue where a whitespace before a semicolon was missing on poetry export (#4575).
• Fixed an issue where markers were not correctly assigned to nested dependencies (#3511).
• Recognize one digit version in wheel filenames (#3338).
• Fixed an issue when locale is unset (#4038).
• Fixed an issue where the fallback to another interpreter didn't work (#3475).
• Merge any marker constraints into constraints with specific markers (#4590).
• Normalize path before hashing so that the generated venv name is independent of case on Windows (#4813).
• Fixed an issue where a dependency wasn't upgrade by using @latest on poetry update (#4945).
• Fixed an issue where conda envs in windows are always reported as broken(#5007).
• Fixed an issue where Poetry doesn't find its own venv on poetry self update (#5049).
• Fix misuse of pretty_constraint (#4932).
• Fixed an issue where the reported python version used for venv creation wasn't correct (#5086).
• Fixed an issue where the searched package wasn't display in the interactive dialog of poetry init (#5076).
• Fixed an issue where Poetry raises an exception on poetry show when no lock files exists (#5242).
• Fixed an issue where Poetry crashes when optional vcs_info.requested_version in direct_url.json wasn't included (#5274).
• Fixed an issue where dependencies with extras were updated despite using --no-update (#4618).
• Fixed various places where poetry writes messages to stdout instead of stderr (#4110, #5179).
• Ensured that when complete packages are created dependency inherits source and resolved refs from package (#4604).
• Ensured that when complete packages are created dependency inherits subdirectory from package if supported (#4604).
• Fixed an issue where POETRY_EXPERIMENTAL_NEW_INSTALLER needs to be set to an empty string to disable it (#3811).

Added

• poetry show <package> now also shows which packages depend on it (#2351).
• The info dialog by poetry about now contains version information about installed poetry and poetry-core (#5288).
• Print error message when poetry publish fails (#3549).
• Added in info output to poetry lock --check (#5081).
• Added new argument --all for poetry env remove to delete all venv of a project at once (#3212).
• Added new argument --without-urls for poetry export to exclude source repository urls from the exported file (#4763).
• Added a new installer.max-workers property to the configuration (#3516).
• Added experimental option virtualenvs.prefer-active-python to detect current activated python (#4852).
• Added better windows shell support (#5053).

Changed

• Drop python3.6 support (#5055).
• Exit with callable return code in generated script (#4456).
• Internal use of the pep517 high level interfaces for package metadata inspections have been replaced with the build package. (#5155).
• Poetry now raises an error if the python version in the project environment is no longer compatible with the project (#4520).

Added

• Poetry now supports dependency groups. (#4260)
• The install command now supports a --sync option to synchronize the environment with the lock file. (#4336)

Changed

• Improved the way credentials are retrieved to better support keyring backends. (#4086)
• The --remove-untracked option of the install command is now deprecated in favor of the new --sync option. (#4336)
• The user experience when installing dependency groups has been improved. (#4336)

Fixed

• Fixed performance issues when resolving dependencies. (#3839)
• Fixed an issue where transitive dependencies of directory or VCS dependencies were not installed or otherwise removed. (#4202)
• Fixed the behavior of the init command in non-interactive mode. (#2899)
• Fixed the detection of the system environment when the setting virtualenvs.create is deactivated. (#4329)
• Fixed the display of possible solutions for some common errors. (#4332)

This release is the first testing release of the upcoming 1.2.0 version.

It drops support for Python 2.7 and 3.5.

Added

• Poetry now supports a plugin system to alter or expand Poetry's functionality. (#3733)
• Poetry now supports PEP 610. (#3876)
• Several configuration options to better control the way virtual environments are created are now available. (#3157, #3711).
• The new command now supports namespace packages. (#2768)
• The add command now supports the --editable option to add packages in editable mode. (#3940)

Changed

• Python 2.7 and 3.5 are no longer supported. (#3405)
• The usage of the get-poetry.py script is now deprecated and is replaced by the install-poetry.py script. (#3706)
• Directory dependencies are now in non-develop mode by default. (poetry-core#98)
• Improved support for PEP 440 specific versions that do not abide by semantic versioning. (poetry-core#140)
• Improved the CLI experience and performance by migrating to the latest version of Cleo. (#3618)
• Packages previously considered as unsafe (pip, setuptools, wheels and distribute) can now be managed as any other package. (#2826)
• The new command now defaults to the Markdown format for README files. (#2768)

Fixed

• Fixed an error where command line options were not taken into account when using the run command. (#3618)
• Fixed an error in the way custom repositories were resolved. (#3406)

Changed

• Poetry now fallback to gather metadata for dependencies via pep517 if parsing pyproject.toml fail (#6206)
• Extras and extras dependencies are now sorted in lock file (#6207)

Fixed

• Fixed an issue where dependencies hashes could not be retrieved when locking due to a breaking change on PyPI JSON API (#5973)

Fixed

• Fixed an issue where envs in MSYS2 always reported as broken (#4942)
• Fixed an issue where conda envs in windows are always reported as broken(#5008)
• Fixed an issue where Poetry doesn't find its own venv on poetry self update (#5048)

Fixed

• Fixed broken caches on Windows due to Path starting with a slash (#4549)
• Fixed JSONDecodeError when installing packages by updating cachecontrol version (#4831)
• Fixed dropped markers in dependency walk (#4686)

Fixed

• Fixed errors when installing packages on Python 3.10. (#4592)
• Fixed an issue where the wrong git executable could be used on Windows. (python-poetry/poetry-core#213)
• Fixed an issue where the Python 3.10 classifier was not automatically added. (python-poetry/poetry-core#215)

Fixed

• Fixed an issue where non-sha256 hashes were not checked. (#4529)

Fixed

• Fixed a security issue where file hashes were not checked prior to installation. (#4420, #4444, python-poetry/poetry-core#193)
• Fixed the detection of the system environment when the setting virtualenvs.create is deactivated. (#4507)
• Fixed an issue where unsafe parameters could be passed to git commands. (python-poetry/poetry-core#203)
• Fixed an issue where the wrong git executable could be used on Windows. (python-poetry/poetry-core#205)

Fixed

• Fixed an error with repository prioritization when specifying secondary repositories. (#4241)
• Fixed the detection of the system environment when the setting virtualenvs.create is deactivated. (#4330, #4407)
• Fixed the evaluation of relative path dependencies. (#4246)
• Fixed environment detection for Python 3.10 environments. (#4387)
• Fixed an error in the evaluation of in/not in markers (python-poetry/poetry-core#189)

Note: Lock files might need to be regenerated for the first fix below to take effect. You can use poetry lock to do so without the --no-update option.

Changed

• This release is compatible with the install-poetry.py installation script to ease the migration path from 1.1 releases to 1.2 releases. (#4192)

Fixed

• Fixed an issue where transitive dependencies of directory or VCS dependencies were not installed or otherwise removed. (#4203)
• Fixed an issue where the combination of the --tree and --no-dev options for the show command was still displaying development dependencies. (#3992)

Fixed

• Fixed export format for path dependencies. (#3121)
• Fixed errors caused by environment modification when executing some commands. (#3253)
• Fixed handling of wheel files with single-digit versions. (#3338)
• Fixed an error when handling single-digit Python markers. (poetry-core#156)
• Fixed dependency markers not being properly copied when changing the constraint leading to resolution errors. (poetry-core#163)
• Fixed an error where VCS dependencies were always updated. (#3947)
• Fixed an error where the incorrect version of a package was locked when using environment markers. (#3945)

Fixed

• Fixed an error in the export command when no lock file existed and a verbose flag was passed to the command. (#3310)
• Fixed an error where the pyproject.toml was not reverted when using the add command. (#3622)
• Fixed errors when using non-HTTPS indices. (#3622)
• Fixed errors when handling simple indices redirection. (#3622)
• Fixed errors when trying to handle newer wheels by using the latest version of poetry-core and packaging. (#3677)
• Fixed an error when using some versions of poetry-core due to an incorrect import . (#3696)

Added

• Added installer.parallel boolean flag (defaults to true) configuration to enable/disable parallel execution of operations when using the new installer. (#3088)

Changed

• When using system environments as an unprivileged user, user site and bin directories are created if they do not already exist. (#3107)

Fixed

• Fixed editable installation of poetry projects when using system environments. (#3107)
• Fixed locking of nested extra activations. If you were affected by this issue, you will need to regenerate the lock file using poetry lock --no-update. (#3229)
• Fixed prioritisation of non-default custom package sources. (#3251)
• Fixed detection of installed editable packages when non-poetry managed .pth file exists. (#3210)
• Fixed scripts generated by editable builder to use valid import statements. (#3214)
• Fixed recursion error when locked dependencies contain cyclic dependencies. (#3237)
• Fixed propagation of editable flag for VCS dependencies. (#3264)