# Poetry 2.4.2

- Product: Poetry (https://whatsnew.fyi/product/poetry)
- Vendor: Poetry
- Date: 2026-08-29
- Version: 2.4.2
- Original notes: https://github.com/python-poetry/poetry/releases/tag/2.4.2
- Permalink: https://whatsnew.fyi/product/poetry/releases/2.4.2

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — Fix an issue where Poetry installs an artifact that is not listed in the lockfile when the package source does not provide a hash for this artifact
- **security** — Fix a path traversal vulnerability when downloading files from a compromised URL and/or package source
- **security** — Fix a path traversal vulnerability in sdist extraction on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 that could allow malicious tarball files to write files outside the target directory

###### Fixed

- Fix an issue where Poetry installs an artifact that is not listed in the lockfile when the package source does not provide a hash for this artifact ([#11030](https://github.com/python-poetry/poetry/pull/11030)).
- Fix a path traversal vulnerability when downloading files from a compromised URL and/or package source ([#11029](https://github.com/python-poetry/poetry/pull/11029)).
- Fix a path traversal vulnerability in sdist extraction on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 that could allow malicious tarball files to write files outside the target directory ([#11027](https://github.com/python-poetry/poetry/pull/11027)).