[dependabot]

Bumps the patches-and-minor-upgrades group with 2 updates in the / directory: poetry and pre-commit.

Updates poetry from 2.4.1 to 2.4.3

Release notes

Sourced from poetry's releases.

2.4.3

Fixed

• Fix an issue where Poetry could not extract sdists on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 (#11037).

2.4.2

Fixed

• Fix an issue where Poetry installs an artifact that is not listed in the lockfile when the package source does not provide a hash for this artifact (#11030).
• Fix a path traversal vulnerability when downloading files from a compromised URL and/or package source (#11029).
• Fix a path traversal vulnerability in sdist extraction on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 that could allow malicious tarball files to write files outside the target directory (#11027).

Changelog

Sourced from poetry's changelog.

[2.4.3] - 2026-09-05

Fixed

• Fix an issue where Poetry could not extract sdists on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 (#11037).

[2.4.2] - 2026-08-29

Fixed

• Fix an issue where Poetry installs an artifact that is not listed in the lockfile when the package source does not provide a hash for this artifact (#11030).
• Fix a path traversal vulnerability when downloading files from a compromised URL and/or package source (#11029).
• Fix a path traversal vulnerability in sdist extraction on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 that could allow malicious tarball files to write files outside the target directory (#11027).

Commits

• 4d69b9b release: bump version to 2.4.3
• 4659943 Fix sdist extraction on older Python versions (#11037)
• 15ce1fc release: bump version to 2.4.2
• 3dd0f2d perf: avoid unnecessary downloads when the index does not provide hashes
• c2f9af2 Fail closed when a locked hash cannot be checked
• 3a194dd fix: reject invalid link filenames when downloading files (#11029)
• 22173fd fix: refuse to write files outside the target directory during sdist extracti...
• See full diff in compare view

Updates pre-commit from 4.6.1 to 4.6.2

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.2

Fixes

• Fix language: node hooks that contain "scripts": {"build": ...} with npm 11.x.
  • Regressed in 4.6.1.
  • #3737 issue by @​mheiges.
  • #3743 PR by @​asottile.

Changelog

Sourced from pre-commit's changelog.

4.6.2 - 2026-08-10

Fixes

• Fix language: node hooks that contain "scripts": {"build": ...} with npm 11.x.
  • Regressed in 4.6.1.
  • #3737 issue by @​mheiges.
  • #3743 PR by @​asottile.

Commits

• 9767b6c v4.6.2
• 42ee3ff Merge pull request #3743 from pre-commit/npm-build-scripts-11-x
• 3056619 fix language: node for hooks with build scripts and npm 11.x
• See full diff in compare view