Fixed
- Fix an issue where Poetry installs an artifact that is not listed in the lockfile when the package source does not provide a hash for this artifact (#11030).
- Fix a path traversal vulnerability when downloading files from a compromised URL and/or package source (#11029).
- Fix a path traversal vulnerability in sdist extraction on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 that could allow malicious tarball files to write files outside the target directory (#11027).