Merge branch 'main' into lock-markers-and-groups3a

.pre-commit-config.yaml

@@ -27,7 +27,7 @@ repos:
       - id: validate_manifest
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.5.4
+    rev: v0.7.3
     hooks:
       - id: ruff
       - id: ruff-format

CHANGELOG.md

@@ -1,5 +1,18 @@
 # Change Log
 
+## [1.8.4] - 2024-10-14
+
+### Added
+
+- **Add official support for Python 3.13** ([#9523](https://github.com/python-poetry/poetry/pull/9523)).
+
+### Changed
+
+- Require `virtualenv>=20.26.6` to mitigate potential command injection when running `poetry shell` in untrusted projects ([#9757](https://github.com/python-poetry/poetry/pull/9757)).
+
+### poetry-core ([`1.9.1`](https://github.com/python-poetry/poetry-core/releases/tag/1.9.1))
+
+- Add `3.13` to the list of available Python versions ([#747](https://github.com/python-poetry/poetry-core/pull/747)).
 
 ## [1.8.3] - 2024-05-08
 

pyproject.toml

@@ -98,8 +98,6 @@ extend-exclude = [
     # External to the project's coding standards
     "tests/fixtures/git/*",
     "tests/fixtures/project_with_setup*/*",
-    "tests/masonry/builders/fixtures/pep_561_stub_only*/*",
-    "tests/utils/fixtures/setups/*",
 ]
 fix = true
 line-length = 88

src/poetry/console/application.py

@@ -16,7 +16,6 @@
 from cleo.events.event_dispatcher import EventDispatcher
 from cleo.exceptions import CleoError
 from cleo.formatters.style import Style
-from cleo.io.null_io import NullIO
 
 from poetry.__version__ import __version__
 from poetry.console.command_loader import CommandLoader
@@ -322,13 +321,10 @@ def configure_installer_for_command(command: InstallerCommand, io: IO) -> None:
         )
         command.set_installer(installer)
 
-    def _load_plugins(self, io: IO | None = None) -> None:
+    def _load_plugins(self, io: IO) -> None:
         if self._plugins_loaded:
             return
 
-        if io is None:
-            io = NullIO()
-
         self._disable_plugins = io.input.has_parameter_option("--no-plugins")
 
         if not self._disable_plugins:

src/poetry/factory.py

@@ -195,7 +195,11 @@ def create_package_source(
                 raise InvalidSourceError(
                     "The PyPI repository cannot be configured with a custom url."
                 )
-            return PyPiRepository(disable_cache=disable_cache, pool_size=pool_size)
+            return PyPiRepository(
+                config=config,
+                disable_cache=disable_cache,
+                pool_size=pool_size,
+            )
 
         try:
             url = source["url"]

src/poetry/inspection/lazy_wheel.py

@@ -10,11 +10,10 @@
 from bisect import bisect_right
 from contextlib import contextmanager
 from tempfile import NamedTemporaryFile
+from typing import IO
 from typing import TYPE_CHECKING
 from typing import Any
-from typing import BinaryIO
 from typing import ClassVar
-from typing import cast
 from urllib.parse import urlparse
 from zipfile import BadZipFile
 from zipfile import ZipFile
@@ -168,14 +167,14 @@ def minimal_intervals_covering(
         yield from self._merge(start, end, left, right)
 
 
-class ReadOnlyIOWrapper(BinaryIO):
-    """Implement read-side ``BinaryIO`` methods wrapping an inner ``BinaryIO``.
+class ReadOnlyIOWrapper(IO[bytes]):
+    """Implement read-side ``IO[bytes]`` methods wrapping an inner ``IO[bytes]``.
 
     This wrapper is useful because Python currently does not distinguish read-only
     streams at the type level.
     """
 
-    def __init__(self, inner: BinaryIO) -> None:
+    def __init__(self, inner: IO[bytes]) -> None:
         self._file = inner
 
     def __enter__(self) -> Self:
@@ -296,7 +295,8 @@ def __init__(
         session: Session | Authenticator,
         delete_backing_file: bool = True,
     ) -> None:
-        super().__init__(cast(BinaryIO, NamedTemporaryFile(delete=delete_backing_file)))
+        inner = NamedTemporaryFile(delete=delete_backing_file)  # noqa: SIM115
+        super().__init__(inner)
 
         self._merge_intervals: MergeIntervals | None = None
         self._length: int | None = None

src/poetry/repositories/cached_repository.py

@@ -25,7 +25,7 @@ class CachedRepository(Repository, ABC):
     CACHE_VERSION = parse_constraint("2.0.0")
 
     def __init__(
-        self, name: str, disable_cache: bool = False, config: Config | None = None
+        self, name: str, *, disable_cache: bool = False, config: Config | None = None
     ) -> None:
         super().__init__(name)
         self._disable_cache = disable_cache

src/poetry/repositories/http_repository.py

@@ -49,11 +49,12 @@ def __init__(
         self,
         name: str,
         url: str,
+        *,
         config: Config | None = None,
         disable_cache: bool = False,
         pool_size: int = requests.adapters.DEFAULT_POOLSIZE,
     ) -> None:
-        super().__init__(name, disable_cache, config)
+        super().__init__(name, disable_cache=disable_cache, config=config)
         self._url = url
         if config is None:
             config = Config.create()

src/poetry/repositories/legacy_repository.py

@@ -30,14 +30,21 @@ def __init__(
         self,
         name: str,
         url: str,
+        *,
         config: Config | None = None,
         disable_cache: bool = False,
         pool_size: int = requests.adapters.DEFAULT_POOLSIZE,
     ) -> None:
         if name == "pypi":
             raise ValueError("The name [pypi] is reserved for repositories")
 
-        super().__init__(name, url.rstrip("/"), config, disable_cache, pool_size)
+        super().__init__(
+            name,
+            url.rstrip("/"),
+            config=config,
+            disable_cache=disable_cache,
+            pool_size=pool_size,
+        )
 
     def package(
         self, name: str, version: Version, extras: list[str] | None = None

src/poetry/repositories/pypi_repository.py

@@ -29,20 +29,25 @@
     from poetry.core.constraints.version import Version
     from poetry.core.constraints.version import VersionConstraint
 
+    from poetry.config.config import Config
+
 SUPPORTED_PACKAGE_TYPES = {"sdist", "bdist_wheel"}
 
 
 class PyPiRepository(HTTPRepository):
     def __init__(
         self,
         url: str = "https://pypi.org/",
+        *,
+        config: Config | None = None,
         disable_cache: bool = False,
-        fallback: bool = True,
         pool_size: int = requests.adapters.DEFAULT_POOLSIZE,
+        fallback: bool = True,
     ) -> None:
         super().__init__(
             "PyPI",
             url.rstrip("/") + "/simple/",
+            config=config,
             disable_cache=disable_cache,
             pool_size=pool_size,
         )

src/poetry/utils/helpers.py

@@ -397,7 +397,7 @@ def extractall(source: Path, dest: Path, zip: bool) -> None:
     else:
         # These versions of python shipped with a broken tarfile data_filter, per
         # https://github.com/python/cpython/issues/107845.
-        broken_tarfile_filter = {(3, 8, 17), (3, 9, 17), (3, 10, 12), (3, 11, 4)}
+        broken_tarfile_filter = {(3, 9, 17), (3, 10, 12), (3, 11, 4)}
         with tarfile.open(source) as archive:
             if (
                 hasattr(tarfile, "data_filter")

src/poetry/vcs/git/system.py

@@ -40,7 +40,7 @@ def run(*args: Any, **kwargs: Any) -> None:
         git_command = find_git_command()
         env = os.environ.copy()
         env["GIT_TERMINAL_PROMPT"] = "0"
-        subprocess.check_call(  # type: ignore[call-arg]
+        subprocess.check_call(
             git_command + list(args),
             stderr=subprocess.DEVNULL,
             stdout=subprocess.DEVNULL,

tests/console/conftest.py

@@ -97,7 +97,8 @@ def poetry(
 @pytest.fixture
 def app(poetry: Poetry) -> PoetryTestApplication:
     app_ = PoetryTestApplication(poetry)
-    app_._load_plugins()
+    io = NullIO()
+    app_._load_plugins(io)
     return app_