Please address the comments from this code review:

## Overall Comments
- Removing `metadata` from `poetry.utils._compat` is a behavioral/binary change for anyone importing it directly; consider keeping a shim re-export (or at least a deprecation path) to avoid breaking external users that relied on `poetry.utils._compat.metadata`.

## Individual Comments

### Comment 1
<location> `src/poetry/utils/env/base_env.py:449-451` </location>
<code_context>
                output = subprocess.check_output(
                    cmd, stderr=stderr, env=env, text=True, encoding="locale", **kwargs
                )
</code_context>

<issue_to_address>
**security (python.lang.security.audit.dangerous-subprocess-use-audit):** Detected subprocess function 'check_output' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.

*Source: opengrep*
</issue_to_address>

### Comment 2
<location> `src/poetry/utils/env/env_manager.py:287-289` </location>
<code_context>
                env_dir = subprocess.check_output(
                    [python, "-c", GET_ENV_PATH_ONELINER], text=True, encoding="locale"
                ).strip("\n")
</code_context>

<issue_to_address>
**security (python.lang.security.audit.dangerous-subprocess-use-audit):** Detected subprocess function 'check_output' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.

*Source: opengrep*
</issue_to_address>

### Comment 3
<location> `src/poetry/utils/env/env_manager.py:331-335` </location>
<code_context>
            python_version_string = subprocess.check_output(
                [python, "-c", GET_PYTHON_VERSION_ONELINER],
                text=True,
                encoding="locale",
            )
</code_context>

<issue_to_address>
**security (python.lang.security.audit.dangerous-subprocess-use-audit):** Detected subprocess function 'check_output' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.

*Source: opengrep*
</issue_to_address>

### Comment 4
<location> `src/poetry/utils/env/base_env.py:453` </location>
<code_context>
    def _run(self, cmd: list[str], **kwargs: Any) -> str:
        """
        Run a command inside the Python environment.
        """
        call = kwargs.pop("call", False)
        env = kwargs.pop("env", dict(os.environ))
        stderr = kwargs.pop("stderr", subprocess.STDOUT)

        try:
            if call:
                assert stderr != subprocess.PIPE
                subprocess.check_call(cmd, stderr=stderr, env=env, **kwargs)
                output = ""
            else:
                output = subprocess.check_output(
                    cmd, stderr=stderr, env=env, text=True, encoding="locale", **kwargs
                )
        except CalledProcessError as e:
            raise EnvCommandError(e)

        return output

</code_context>

<issue_to_address>
**suggestion (code-quality):** Explicitly raise from a previous error ([`raise-from-previous-error`](https://docs.sourcery.ai/Reference/Default-Rules/suggestions/raise-from-previous-error/))

```suggestion
            raise EnvCommandError(e) from e
```
</issue_to_address>

Please address the comments from this code review:

## Overall Comments
- In `poetry/utils/_compat.py`, `__getattr__` should raise `AttributeError` for unknown attributes instead of returning `None` to preserve normal module attribute semantics and avoid confusing failures in callers relying on attribute access.
- The Perl one-liner in `.github/workflows/.tests-matrix.yaml` that rewrites `requires-python` now builds a somewhat convoluted string (`"~='${PYTHON_VERSION}'"`); double-check the resulting line in `pyproject.toml` is syntactically valid and matches the intended version constraint.

## Individual Comments

### Comment 1
<location> `src/poetry/utils/_compat.py:55-64` </location>
<code_context>
         return locale.getencoding()


+def __getattr__(name: str) -> object:
+    if name == "metadata":
+        warnings.warn(
+            "Importing `metadata` from `poetry.utils._compat` is deprecated;"
+            " use `importlib.metadata` directly.",
+            DeprecationWarning,
+            stacklevel=2,
+        )
+        return _metadata
+    return None
+
+
</code_context>

<issue_to_address>
**issue (bug_risk):** Module-level __getattr__ should raise AttributeError for unknown attributes instead of returning None.

Returning `None` here violates the expected module-level `__getattr__` contract and will confuse callers and tools that rely on `AttributeError` (e.g. `hasattr`, `getattr(..., default)`). Please change the final line to `raise AttributeError(name)` so only `"metadata"` is special-cased and all other names behave like normal missing attributes.
</issue_to_address>

### Comment 2
<location> `tests/console/commands/test_about.py:20` </location>
<code_context>
 from __future__ import annotations

-from poetry.utils._compat import metadata
+from importlib import metadata


</code_context>

<issue_to_address>
**suggestion (testing):** Consider adding a dedicated test for the deprecated `poetry.utils._compat.metadata` access path and its deprecation warning.

Since `metadata` is now exposed via `__getattr__` on `poetry.utils._compat` with a `DeprecationWarning`, please add a test that:

1. Imports `metadata` from `poetry.utils._compat`.
2. Uses `pytest.warns` to assert a `DeprecationWarning`.
3. Optionally confirms the object matches `importlib.metadata` (e.g. via `version` or `Distribution`).

This will validate the deprecated access path and protect against regressions in the shim implementation.

Suggested implementation:

```python
def test_about(tester: CommandTester) -> None:


def test_about(tester: CommandTester) -> None:
    from importlib import metadata

    tester.execute()


def test_deprecated_metadata_access_path() -> None:
    import importlib.metadata as importlib_metadata
    from poetry.utils import _compat

    import pytest

    with pytest.warns(DeprecationWarning):
        compat_metadata = _compat.metadata

    assert compat_metadata is importlib_metadata

```

1. If `pytest` is already imported at the top of `tests/console/commands/test_about.py`, remove the inline `import pytest` inside `test_deprecated_metadata_access_path` and use the existing import instead.
2. If your test suite prefers grouping imports at the top of the file, move `import importlib.metadata as importlib_metadata` and `from poetry.utils import _compat` to the module-level imports and adjust the test accordingly.
</issue_to_address>

### Comment 3
<location> `src/poetry/utils/env/base_env.py:449-451` </location>
<code_context>
                output = subprocess.check_output(
                    cmd, stderr=stderr, env=env, text=True, encoding="locale", **kwargs
                )
</code_context>

<issue_to_address>
**security (python.lang.security.audit.dangerous-subprocess-use-audit):** Detected subprocess function 'check_output' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.

*Source: opengrep*
</issue_to_address>

### Comment 4
<location> `src/poetry/utils/env/env_manager.py:287-289` </location>
<code_context>
                env_dir = subprocess.check_output(
                    [python, "-c", GET_ENV_PATH_ONELINER], text=True, encoding="locale"
                ).strip("\n")
</code_context>

<issue_to_address>
**security (python.lang.security.audit.dangerous-subprocess-use-audit):** Detected subprocess function 'check_output' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.

*Source: opengrep*
</issue_to_address>

### Comment 5
<location> `src/poetry/utils/env/env_manager.py:331-335` </location>
<code_context>
            python_version_string = subprocess.check_output(
                [python, "-c", GET_PYTHON_VERSION_ONELINER],
                text=True,
                encoding="locale",
            )
</code_context>

<issue_to_address>
**security (python.lang.security.audit.dangerous-subprocess-use-audit):** Detected subprocess function 'check_output' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.

*Source: opengrep*
</issue_to_address>

### Comment 6
<location> `src/poetry/utils/env/base_env.py:453` </location>
<code_context>
    def _run(self, cmd: list[str], **kwargs: Any) -> str:
        """
        Run a command inside the Python environment.
        """
        call = kwargs.pop("call", False)
        env = kwargs.pop("env", dict(os.environ))
        stderr = kwargs.pop("stderr", subprocess.STDOUT)

        try:
            if call:
                assert stderr != subprocess.PIPE
                subprocess.check_call(cmd, stderr=stderr, env=env, **kwargs)
                output = ""
            else:
                output = subprocess.check_output(
                    cmd, stderr=stderr, env=env, text=True, encoding="locale", **kwargs
                )
        except CalledProcessError as e:
            raise EnvCommandError(e)

        return output

</code_context>

<issue_to_address>
**suggestion (code-quality):** Explicitly raise from a previous error ([`raise-from-previous-error`](https://docs.sourcery.ai/Reference/Default-Rules/suggestions/raise-from-previous-error/))

```suggestion
            raise EnvCommandError(e) from e
```
</issue_to_address>