build(deps): bump poetry from 1.8.4 to 2.5.0 in /.github/workflows

[dependabot]

Bumps poetry from 1.8.4 to 2.5.0.

Release notes

Sourced from poetry's releases.

2.5.0

Added

• Add an installer.builtin-uninstall setting to uninstall packages with a built-in uninstaller instead of invoking pip uninstall (#10931).
• Add official support for Python 3.15 (#11046).

Changed

• Do not send credentials configured for an https repository via http (#11073).
• Fail with an error when the current Python version is not compatible with the project and virtualenvs.create is false (#10941).
• Validate version constraints that are entered interactively in poetry init (#10909).
• Include the path of the pyproject.toml file in the message about already present packages in poetry add (#10908).
• Improve performance of processing package links and repository pages (#10895, #10896, #10903, #10949, #10951, #10953).
• Improve performance of dependency resolution (#10907, #10954).
• Improve performance of choosing and installing wheels (#10905, #10958).
• Improve performance by avoiding redundant keyring lookups for repositories without credentials (#10959).
• Improve performance by reducing the number of subprocesses to discover virtual environment data (#11042).
• Improve performance of poetry search for single-token queries (#10906).
• Improve startup time by deferring the import of requests (#11004).
• Improve performance of schema validation by caching compiled JSON schema validators (#11033).

Fixed

• Fix an issue where credentials of the wrong repository were used under certain circumstances when multiple repositories were configured on the same host (#11072).
• Fix an issue where credentials of a repository on another host were used for git dependencies if the path of the URL was the same (#11074).
• Fix an issue where dependency resolution failed for conflicting requirements of different packages even though the requirements had mutually exclusive markers (#10944).
• Fix an issue where dependency resolution failed when the same package was required with different extras in several optional dependencies or dependency groups (#10943).
• Fix an issue where dependency resolution failed with a KeyError (#11008).
• Fix an issue where the dependencies of an extra were missing in the lock file after adding the extra to a locked dependency, e.g. a git dependency, in the pyproject.toml file (#10987).
• Fix an issue where a path or git dependency was not reinstalled when its develop setting changed (#11022).
• Fix an issue where scripts of type file were not installed when installing the project (#10736).
• Fix an issue where GUI scripts were not installed when installing the project (#10973).
• Fix an issue where a relative path was written to direct_url.json for path dependencies (#10917).
• Fix an issue where poetry show <package> showed a version that was not relevant for the current environment if there were multiple versions of the package in the lock file (#11003).
• Fix an issue where poetry show --outdated did not find newer versions of packages from sources with explicit priority (#10982).
• Fix an issue where poetry env activate ignored the environment that was determined by the application, e.g. when using --directory (#10916).
• Fix an issue where poetry init proposed an invalid package name if the directory name was not a valid package name (#10975).

Docs

• Document the --license option of poetry init and poetry new (#11064).
• Clarify which dependencies are locked when running poetry update with dependency groups (#11024).
• Clarify the portability of path dependencies (#11020).
• Clarify the usage of poetry run with console scripts (#10984).
• Clarify what --no-cache disables (#10915).
• Document how to use package sources for poetry self update (#10923).
• Fix the stale minimum Python version (#11050).
• Update outdated links (#10913, #10938, #11000, #11043).

... (truncated)

Changelog

Sourced from poetry's changelog.

[2.5.0] - 2026-09-19

Added

• Add an installer.builtin-uninstall setting to uninstall packages with a built-in uninstaller instead of invoking pip uninstall (#10931).
• Add official support for Python 3.15 (#11046).

Changed

• Do not send credentials configured for an https repository via http (#11073).
• Fail with an error when the current Python version is not compatible with the project and virtualenvs.create is false (#10941).
• Validate version constraints that are entered interactively in poetry init (#10909).
• Include the path of the pyproject.toml file in the message about already present packages in poetry add (#10908).
• Improve performance of processing package links and repository pages (#10895, #10896, #10903, #10949, #10951, #10953).
• Improve performance of dependency resolution (#10907, #10954).
• Improve performance of choosing and installing wheels (#10905, #10958).
• Improve performance by avoiding redundant keyring lookups for repositories without credentials (#10959).
• Improve performance by reducing the number of subprocesses to discover virtual environment data (#11042).
• Improve performance of poetry search for single-token queries (#10906).
• Improve startup time by deferring the import of requests (#11004).
• Improve performance of schema validation by caching compiled JSON schema validators (#11033).

Fixed

• Fix an issue where credentials of the wrong repository were used under certain circumstances when multiple repositories were configured on the same host (#11072).
• Fix an issue where credentials of a repository on another host were used for git dependencies if the path of the URL was the same (#11074).
• Fix an issue where dependency resolution failed for conflicting requirements of different packages even though the requirements had mutually exclusive markers (#10944).
• Fix an issue where dependency resolution failed when the same package was required with different extras in several optional dependencies or dependency groups (#10943).
• Fix an issue where dependency resolution failed with a KeyError (#11008).
• Fix an issue where the dependencies of an extra were missing in the lock file after adding the extra to a locked dependency, e.g. a git dependency, in the pyproject.toml file (#10987).
• Fix an issue where a path or git dependency was not reinstalled when its develop setting changed (#11022).
• Fix an issue where scripts of type file were not installed when installing the project (#10736).
• Fix an issue where GUI scripts were not installed when installing the project (#10973).
• Fix an issue where a relative path was written to direct_url.json for path dependencies (#10917).
• Fix an issue where poetry show <package> showed a version that was not relevant for the current environment if there were multiple versions of the package in the lock file (#11003).
• Fix an issue where poetry show --outdated did not find newer versions of packages from sources with explicit priority (#10982).
• Fix an issue where poetry env activate ignored the environment that was determined by the application, e.g. when using --directory (#10916).
• Fix an issue where poetry init proposed an invalid package name if the directory name was not a valid package name (#10975).

Docs

• Document the --license option of poetry init and poetry new (#11064).
• Clarify which dependencies are locked when running poetry update with dependency groups (#11024).

... (truncated)

Commits

• 165fb4b release: bump version to 2.5.0
• c93fd63 update poetry-core (#10921)
• 32356ae chore: update dependencies (#11075)
• d266d45 test: accept compatible extension wheel tags (#11014)
• c8790a3 add Python 3.15 to tests matrix (#11046)
• a416efd authenticator: match host when looking up git credentials (#11074)
• e078ebf authenticator: do not send credentials configured for https with http (#11073)
• 8711c83 authenticator: sort candidates by common path segments instead of prefixes (#...
• 52fd287 solver: fix KeyError due to orphan decisions (#11008)
• 6de1922 chore: update runner images (#10852)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #1181.