chore(deps): bump nltk from 3.9.4 to 3.10.3 in /envs/textarena_env - #1116
chore(deps): bump nltk from 3.9.4 to 3.10.3 in /envs/textarena_env#1116dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [nltk](https://github.com/nltk/nltk) from 3.9.4 to 3.10.3. - [Release notes](https://github.com/nltk/nltk/releases) - [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog) - [Commits](nltk/nltk@3.9.4...v3.10.3) --- updated-dependencies: - dependency-name: nltk dependency-version: 3.10.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 89a31c9. Configure here.
| sdist = { url = "https://files.pythonhosted.org/packages/e0/e6/fe51d2bb1a3b446f59c5c8165999a9fee208bc346af90a7cbf7657bc0d75/nltk-3.10.3.tar.gz", hash = "sha256:bb9327a461c3811c2fa4900e03840401f2126adfb30c0072827c433bd2444ea4", size = 5137152, upload-time = "2026-08-12T23:46:37.258Z" } | ||
| wheels = [ | ||
| { url = "https://files.pythonhosted.org/packages/9d/91/04e965f8e717ba0ab4bdca5c112deeab11c9e750d94c4d4602f050295d39/nltk-3.9.4-py3-none-any.whl", hash = "sha256:f2fa301c3a12718ce4a0e9305c5675299da5ad9e26068218b69d692fda84828f", size = 1552087, upload-time = "2026-03-24T06:13:38.47Z" }, | ||
| { url = "https://files.pythonhosted.org/packages/b6/6d/ebd2af4640b12168fdf0cb74b6118df2f32a2f62ec7e0c06fbfd80706639/nltk-3.10.3-py3-none-any.whl", hash = "sha256:ff9598a8e20518ee0d557745890cc4435b9578489e2dcbc69c4f81fa060caf7c", size = 1798643, upload-time = "2026-08-12T23:44:13.478Z" }, |
There was a problem hiding this comment.
NLTK download fails with NO_PROXY
High Severity
Pinning nltk 3.10.3 introduces a known regression (nltk#3748) where nltk.download() raises a pathsec PermissionError whenever NO_PROXY is set, even with no proxy in use. This environment calls nltk.download() during construction by default, so startup fails in Docker and corporate setups that define NO_PROXY.
Reviewed by Cursor Bugbot for commit 89a31c9. Configure here.
There was a problem hiding this comment.
Alignment Review Report
Dependabot lock-only bump of nltk 3.9.4 → 3.10.3 in envs/textarena_env (single file: uv.lock). Verified end-to-end — clean and strongly security-positive. This supersedes the now-closed #1031 (which targeted 3.10.0 and never merged; the floor on main is still nltk>=3.9.3, which 3.10.3 satisfies, so no pyproject.toml edit was needed).
Automated Checks
- Lint: PASS (for this PR).
lint.shexits non-zero only on ~26 pre-existingenvs/**/*.pyformatting-drift files; this PR touches onlyuv.lock(TOML/lock aren't linted). CI'slintjob is green. - Debug code: CLEAN.
check-debug.shscanssrc/only; no.pychanged here.
Open RFCs Context
Scanned rfcs/: 000/001/002/003/005/008 In Review, 010 Draft, 004 (no status). None cover packaging / dependency management / PyPI, so a dep bump has no RFC surface.
Tier 1: Fixes Required
None.
uv lock --checkpasses (127 pkgs); nltk + defusedxml hashes verified against PyPI (see inline).- Born-clean lock: revision
3unchanged, 0 mirror refs (allpypi.org/simple) → no index-flip, no revision bump. - Package-set delta = only
defusedxml 0.7.1added +nltkchanged; no other artifact hashes touched. - CI is fully green (lint, test 3.11/3.12,
validate-env-locks, build,check-env-docs, pkg smoke-test).
Tier 2: Alignment Discussion
Principle Conflicts
None identified. A dependency bump touches no Gym API / rewards / client-server / MCP-WS / credential surface. The new defusedxml hardens XML parsing (aligns with the "cutting-edge for stability" trade-off and the security posture).
RFC Conflicts
None identified.
Non-blocking notes (unchanged files → not fixable in this PR)
- Dependabot process mismatch (recurring):
.github/dependabot.ymlsetsexclude-paths: ["envs/**"](lines 8-9), yet this nativedependabot/uv/envs/textarena_env/...PR still editsenvs/textarena_env/uv.lock. Theuvecosystem isn't honoringexclude-paths(valid key, platform limitation); the intended path for env bumps is thecodex/dependabot-envs-*aggregate. cc @burtenshaw. - Deploy:
server/Dockerfileconsumes the lock viauv sync --frozen(L45), but the revision is unchanged (already 3) so there's no new base-uvrequirement; nltk 3.10.3 + defusedxml install with valid hashes and the CVE fix lands at deploy. - Compat:
server/environment.pyuses onlynltk.download("words")+nltk.download("averaged_perceptron_tagger_eng")(stable API, current_engtagger name); nltk is in the CI test install list, so it's exercised.
Summary
- 0 mechanical issues to fix
- 0 alignment points for human review
- 0 RFC conflicts
Security-positive (clears 24 nltk advisories, 10 of them fixed only in 3.10.3). Suggested reviewers: @Darktex (security/reproducibility), @burtenshaw (dependabot process). Recommendation: safe to merge.
Sent by Cursor Automation: Pre-review
| [[package]] | ||
| name = "nltk" | ||
| version = "3.9.4" | ||
| version = "3.10.3" |
There was a problem hiding this comment.
nltk 3.9.4 → 3.10.3 — verified against PyPI:
- wheel
sha256:ff9598a8…caf7c(1,798,643 B) and sdistsha256:bb9327a4…4ea4(5,137,152 B) match the lock exactly;yanked=false;requires_python >=3.10matches the env. - Runtime deps =
defusedxml, click, joblib, regex>=2021.8.3, tqdm— all already locked;defusedxmlis the only addition.
Strong security fix. nltk 3.9.4 now carries 24 advisories, all cleared in 3.10.3 (0 vulns reported). Notably 10 are fixed only in 3.10.3 (not 3.10.0, the earlier #1031 target) — e.g. CVE-2026-81724 / -81722 / -81726 / -81727, CVE-2026-79657 / -79674 / -79675 / -79676, CVE-2026-78680 / -78682 — so landing exactly 3.10.3 (rather than 3.10.0) matters. uv lock --check passes.
| ] | ||
|
|
||
| [[package]] | ||
| name = "defusedxml" |
There was a problem hiding this comment.
New transitive dep defusedxml 0.7.1, pulled in because nltk 3.10.x adds defusedxml to its runtime requirements. Verified against PyPI:
- wheel
sha256:a352e7e4…6a61(25,604 B) and sdistsha256:1bb3032d…a3e69(75,520 B) match the lock; - zero dependencies (adds nothing else to the tree),
requires_python >=2.7(compatible with the env's>=3.10),yanked=false, 0 known vulns.
It's a security-hardening XML parser (XXE / billion-laughs mitigation), so this addition is net-positive.
| dependencies = [ | ||
| { name = "cryptography", marker = "(python_full_version < '3.11' and sys_platform == 'emscripten') or (python_full_version < '3.11' and sys_platform == 'win32') or (sys_platform != 'emscripten' and sys_platform != 'win32')" }, | ||
| { name = "jeepney", marker = "(python_full_version < '3.11' and sys_platform == 'emscripten') or (python_full_version < '3.11' and sys_platform == 'win32') or (sys_platform != 'emscripten' and sys_platform != 'win32')" }, | ||
| { name = "cryptography" }, |
There was a problem hiding this comment.
FYI (not a concern): beyond the nltk bump, the re-lock also normalized environment markers on secretstorage (here) and pandas (two blocks above) — e.g. dropping the (python_full_version < '3.11' and …) or (sys_platform != 'emscripten' and sys_platform != 'win32') guards on cryptography/jeepney. No wheel/sdist/hash changed for these packages, and the effective resolution on the linux deploy target is identical; it's a benign metadata simplification from a newer uv rewriting the lock. Flagging only so the extra hunks don't read as an unrelated change.
1 participant
Bumps nltk from 3.9.4 to 3.10.3.
Release notes
Sourced from nltk's releases.
... (truncated)
Changelog
Sourced from nltk's changelog.
... (truncated)
Commits
303f6e2Prepare release 3.10.3 (#3745)cf2aaacMerge pull request #3744 from alvations/ci-guard-open6cd8320test: robustness on Python 3.14 / 3.14t CI (UnicodeDecodeError + timing flake)e965330fix: perceptron save_to_json breaks on Windows (os.open can't fd-open a direc...df1bb4ctest: make pathsec security tests platform-independent (fix Linux/Windows CI)0e5c7beci: guard against un-sandboxed open() in sandbox-sensitive modules (#3740)5017826Merge commit from fork40d0f06Triple-check hardening: perceptron TOCTOU squat, pathsec fd-leak, bcp47 entit...483c5feHarden path-traversal / file-I/O sandbox: close write-side symlink TOCTOU + s...722778fMerge commit from forkDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Lockfile-only dependency bump with security fixes; possible behavior shifts from NLTK 3.10’s stricter path/sandbox defaults when downloading or reading NLTK data.
Overview
Updates
envs/textarena_env/uv.lockto resolve NLTK 3.9.4 → 3.10.3 (nopyproject.tomlchange; existingnltk>=3.9.3still satisfies the new pin).The lock refresh also pulls in
defusedxmlas a new NLTK dependency and includes incidental resolver/metadata tweaks for other locked packages (e.g. pandas, secretstorage dependency markers).For textarena_env, NLTK is used at runtime to download
wordsandaveraged_perceptron_tagger_engwhenTEXTARENA_DOWNLOAD_NLTKis enabled—this bump mainly delivers upstream security and sandbox hardening from the 3.10.x line rather than app code changes.Reviewed by Cursor Bugbot for commit 89a31c9. Bugbot is set up for automated code reviews on this repo. Configure here.