CVS commit: pkgsrc/devel/py-poetry

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Mon Aug 31 09:34:31 UTC 2026

Modified Files:
        pkgsrc/devel/py-poetry: Makefile distinfo

Log Message:
py-poetry: updated to 2.4.2

2.4.2

Fixed

Fix an issue where Poetry installs an artifact that is not listed in the lockfile when the package source does not provide a hash for this artifact
Fix a path traversal vulnerability when downloading files from a compromised URL and/or package source
Fix a path traversal vulnerability in sdist extraction on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 that could allow malicious tarball files to write files outside the target directory


To generate a diff of this commit:
cvs rdiff -u -r1.35 -r1.36 pkgsrc/devel/py-poetry/Makefile
cvs rdiff -u -r1.24 -r1.25 pkgsrc/devel/py-poetry/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/py-poetry/Makefile
diff -u pkgsrc/devel/py-poetry/Makefile:1.35 pkgsrc/devel/py-poetry/Makefile:1.36
--- pkgsrc/devel/py-poetry/Makefile:1.35        Sun Jun 28 15:41:17 2026
+++ pkgsrc/devel/py-poetry/Makefile     Mon Aug 31 09:34:31 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.35 2026/06/28 15:41:17 wiz Exp $
+# $NetBSD: Makefile,v 1.36 2026/08/31 09:34:31 adam Exp $
 
-DISTNAME=      poetry-2.4.1
+DISTNAME=      poetry-2.4.2
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME}
 CATEGORIES=    devel python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=p/poetry/}

Index: pkgsrc/devel/py-poetry/distinfo
diff -u pkgsrc/devel/py-poetry/distinfo:1.24 pkgsrc/devel/py-poetry/distinfo:1.25
--- pkgsrc/devel/py-poetry/distinfo:1.24        Tue May 26 07:05:18 2026
+++ pkgsrc/devel/py-poetry/distinfo     Mon Aug 31 09:34:31 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.24 2026/05/26 07:05:18 adam Exp $
+$NetBSD: distinfo,v 1.25 2026/08/31 09:34:31 adam Exp $
 
-BLAKE2s (poetry-2.4.1.tar.gz) = 6075fc48e550abcdd1514f87cfa977350da75eb26e74dbdf341895a96bc08c5c
-SHA512 (poetry-2.4.1.tar.gz) = 71f0a959058fe8c1d2495f486c8f7771de0ec7166fc1ed1d6b7a2813e448b5ffb1c7429c5d5d1930fce33caf3f0f2f5c5a0b9fd199a53c7aa1d2ca6e9d25645b
-Size (poetry-2.4.1.tar.gz) = 3282327 bytes
+BLAKE2s (poetry-2.4.2.tar.gz) = 3d2a5d95fad01259b6782938575af89559d5393141c7b9500d1aaf1643be2abf
+SHA512 (poetry-2.4.2.tar.gz) = 8a3a013662cc32a02adace643344dd88dbd1f48316ee6e32d630d28af46c422654a8795a7c96e0f2cdf06d885c1d32bb59a6b453f4e20a032fd6a9876902d4b2
+Size (poetry-2.4.2.tar.gz) = 3285341 bytes