release: bump version to 2.3.3

[radoering]

Fixed

• Fix a path traversal vulnerability in the wheel installer that could allow malicious wheel files to write files outside the intended installation directory (#10792).
• Fix an issue where git dependencies from annotated tags could not be updated (#10719).
• Fix an issue where empty VIRTUAL_ENV or CONDA_PREFIX environment variables (e.g., after conda deactivate) would cause Poetry to incorrectly detect an active virtualenv (#10784).
• Fix an issue where an incomprehensible error message was printed when .venv was a file instead of a directory (#10777).
• Fix an issue where HTTP Basic Authentication credentials could be corrupted during request preparation, causing authentication failures with long tokens (#10748).
• Fix an issue where poetry publish --no-interaction --build requested user interaction (#10769).
• Fix an issue where poetry init and poetry new created a deprecated project.license format (#10787).

Docs

• Clarify the differences between poetry install and poetry update (#10713).
• Clarify the section of fields in the pyproject.toml examples (#10753).
• Add a note about the different installation location when Python from the Microsoft Store is used (#10759).
• Fix the system requirements for Poetry (#10739).
• Fix the poetry cache clear example (#10749).
• Fix the link to pipx installation instructions (#10783).

poetry-core (2.3.2)

• Fix an issue where platform_release could not be parsed on Debian Trixie (#930).
• Fix an issue where using project.readme.text in the pyproject.toml file resulted in broken metadata (#914).
• Fix an issue where dependency groups were considered equal when their resolved dependencies were equal, even if the groups themselves were not (#919).
• Fix an issue where removing a dependency from a group that included another group resulted in other dependencies being added to the included group (#922).
• Fix an issue where PEP 735 include-group entries were lost when [tool.poetry.group] also defined include-groups for the same group (#924).
• Fix an issue where the union of <value> not in <marker> constraints was wrongly treated as always satisfied (#925).
• Fix an issue where a post release with a local version identifier was wrongly allowed by a > version constraint (#921).
• Fix an issue where a version with the local version identifier 0 was treated as equal to the corresponding public version (#920).
• Fix an issue where a != <version> constraint wrongly disallowed pre releases and post releases of the specified version (#929).
• Fix an issue where in and not in constraints were wrongly not allowed by specific compound constraints (#927).

Summary by Sourcery

Release version 2.3.3 with security, reliability, and documentation improvements, and update metadata accordingly.

Bug Fixes:

• Address a path traversal vulnerability in the wheel installer that allowed writes outside the installation directory.
• Resolve issues with updating git dependencies from annotated tags.
• Fix incorrect virtualenv detection when VIRTUAL_ENV or CONDA_PREFIX environment variables are empty.
• Improve error handling when a .venv path is a file instead of a directory.
• Prevent corruption of HTTP Basic Authentication credentials during request preparation, especially for long tokens.
• Ensure poetry publish --no-interaction --build runs without requesting user interaction.
• Update poetry init and poetry new to avoid generating deprecated project.license metadata.
• Update to poetry-core 2.3.2 to fix multiple issues in environment detection, metadata generation, dependency grouping, and version/marker constraint handling.

Documentation:

• Clarify differences between poetry install and poetry update.
• Improve explanations of field sections in pyproject.toml examples.
• Document the different installation location when using Python from the Microsoft Store.
• Correct Poetry system requirements documentation.
• Fix the poetry cache clear usage example.
• Update the link to pipx installation instructions.

Chores:

• Update changelog and version references for the 2.3.3 release.

[sourcery-ai]

Reviewer's Guide

Release prep for Poetry 2.3.3: bump the package version and add a 2.3.3 entry to the changelog, including linked bugfixes, docs updates, and the bundled poetry-core 2.3.2 changes, plus update comparison links.

File-Level Changes

Change	Details	Files
Add a detailed 2.3.3 release entry to the changelog and update release comparison links.	Insert a new 2.3.3 section documenting fixed bugs, documentation updates, and bundled poetry-core 2.3.2 changes. Update the [Unreleased] comparison link to start from 2.3.3 instead of 2.3.2. Add a new [2.3.3] tag link to the releases list.	CHANGELOG.md
Bump the project version metadata from 2.3.2 to 2.3.3.	Update the project.version field to 2.3.3 to match the new release.	pyproject.toml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}