Vendor
Dulwich versions before 1.2.20 contain a parsing vulnerability that causes inconsistent tree header resolution, potentially allowing code execution when used by Poetry 2.5.1.