cache clear accepts parent paths and deletes directories outside the repository cache #11208

Description

poetry cache clear accepts a cache name containing parent segments. With poetry cache clear ../.. --all, the resolved directory is outside Poetry's repository cache, and the command deletes it — including sibling cache directories and virtualenvs/artifacts under POETRY_CACHE_DIR.

Reproduction

Using an isolated cache directory:

$ export POETRY_CACHE_DIR=/tmp/poetry-cache
$ mkdir -p /tmp/poetry-cache/artifacts
$ touch /tmp/poetry-cache/artifacts/sentinel
$ poetry cache clear ../.. --all --no-interaction
[Errno 2] No such file or directory: PosixPath('/tmp/poetry-cache/cache/repositories/../..')
$ ls /tmp/poetry-cache
ls: /tmp/poetry-cache: No such file or directory

The whole POETRY_CACHE_DIR (and its artifacts/ sibling) is gone. Deeper .. sequences can escape the cache root entirely.

Expected

A name that escapes the repository cache directory should be rejected with is not a valid repository cache and delete nothing.

Actual

The name passes validation and the directory is deleted.

Cause

clear.py computes cache_dir = config.repository_cache_directory / root and checks cache_dir.relative_to(config.repository_cache_directory). relative_to is lexical and accepts ..; the path is never resolved. FileCache.flush() then calls shutil.rmtree on the resolved path outside the repository cache.

Environment

Poetry main at 6ecadf5b71309b1da4f00949cc349a79884cff8f (2026-11-05), Python 3.12, macOS. The behavior is path-based and platform-independent.

I have a fix with a regression test ready and will open a PR.