Add Wiktionary th-pron transliterator to pythainlp.transliterate

.github/workflows/bandit.yml

@@ -0,0 +1,66 @@
+# SPDX-FileCopyrightText: 2026-present PyThaiNLP Project
+# SPDX-License-Identifier: Apache-2.0
+
+# Bandit is a tool designed to find common security issues in Python code.
+# https://github.com/pycqa/bandit
+
+name: Bandit
+
+on:
+  push:
+    branches:
+      - dev
+      - main
+    paths-ignore:
+      - '**.cff'
+      - '**.json'
+      - '**.md'
+      - '**.rst'
+      - '**.txt'
+      - 'docs/**'
+  pull_request:
+    branches:
+      - dev
+      - main
+    paths-ignore:
+      - '**.cff'
+      - '**.json'
+      - '**.md'
+      - '**.rst'
+      - '**.txt'
+      - 'docs/**'
+
+# Avoid duplicate runs for the same source branch and repository.
+# For pull_request events, uses the source repo name from
+# github.event.pull_request.head.repo.full_name; otherwise uses github.repository.
+# For push events, uses the branch name from github.ref_name.
+# For pull_request events, uses the source branch name from github.head_ref.
+# This ensures events for the same repo and branch share the same group,
+# and avoids cross-fork collisions when branch names are reused.
+concurrency:
+  group: >-
+    ${{ github.workflow }}-${{
+      github.event.pull_request.head.repo.full_name || github.repository
+    }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  bandit:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6.0.2
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.x"
+          cache: "pip"
+
+      - name: Install bandit
+        run: pip install "bandit>=1.9.4"
+
+      - name: Run bandit
+        run: bandit -r pythainlp -c pyproject.toml

.github/workflows/codemeta2cff.yml

@@ -25,7 +25,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.3
 
       - name: Generate CITATION.cff from codemeta.json
         uses: caltechlibrary/codemeta2cff@99ce10831c3037a067c3d9551d455638e0b438ac  #v0.3.3
@@ -37,7 +37,7 @@ jobs:
           printf '\n```' >> $GITHUB_STEP_SUMMARY
 
       - name: Validate CITATION.cff
-        uses: dieghernan/cff-validator@114aae53e1850c3757733beb60036941900e3dc3  #v4
+        uses: dieghernan/cff-validator@54c8e737314b948f25c0e5524a9d8ae3f39b207b  #v5.0.1
 
       - name: Commit and push updated CITATION.cff
         uses: EndBug/add-and-commit@290ea2c423ad77ca9c62ae0f5b224379612c0321  #v10.0.0

.github/workflows/codeql-analysis.yml

@@ -62,11 +62,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v6.0.3
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@v4.36.2
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -77,7 +77,7 @@ jobs:
     # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v4
+      uses: github/codeql-action/autobuild@v4.36.2
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -91,4 +91,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@v4.36.2

.github/workflows/corpus.yml

@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.3
 
       - name: Set up Python
         uses: actions/setup-python@v6

.github/workflows/deploy-docs.yml

@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@v6.0.3
     - name: Set up Python
       uses: actions/setup-python@v6
       with:
@@ -38,7 +38,7 @@ jobs:
         cd docs && make html
         cd ..
     - name: Deploy documentation
-      uses: peaceiris/actions-gh-pages@v4
+      uses: peaceiris/actions-gh-pages@v4.1.0
       with:
         personal_token: ${{ secrets.PERSONAL_TOKEN }}
         publish_dir: ./docs/_build/html

.github/workflows/lint.yml

@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@v6.0.3
     - name: Ruff
       uses: astral-sh/ruff-action@v3
       with:

.github/workflows/markdownlint.yml

@@ -24,11 +24,11 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.3
         with:
           fetch-depth: 0
 
-      - uses: DavidAnson/markdownlint-cli2-action@v23.1.0
+      - uses: DavidAnson/markdownlint-cli2-action@v23.2.0
         with:
           globs: |
             **/*.md

.github/workflows/mypy.yml

@@ -46,7 +46,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.3
 
       - name: Set up Python
         uses: actions/setup-python@v6

.github/workflows/publish-versioned-docs.yml

@@ -31,19 +31,19 @@ jobs:
       run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
 
     - name: Checkout pythainlp (for scripts)
-      uses: actions/checkout@v6
+      uses: actions/checkout@v6.0.3
       with:
         path: pythainlp
 
     - name: Checkout dev-docs repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v6.0.3
       with:
         repository: PyThaiNLP/dev-docs
         token: ${{ secrets.PERSONAL_TOKEN }}
         path: dev-docs
 
     - name: Checkout docs repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v6.0.3
       with:
         repository: PyThaiNLP/docs
         token: ${{ secrets.PERSONAL_TOKEN }}

.github/workflows/pypi-publish.yml

@@ -52,7 +52,7 @@ jobs:
       build: ${{ steps.check_build_trigger.outputs.build }}
     steps:
     - name: Checkout source code
-      uses: actions/checkout@v6
+      uses: actions/checkout@v6.0.3
       with:
         ref: ${{ github.event.pull_request.head.sha }}
     - id: check_build_trigger
@@ -71,7 +71,7 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@v6.0.3
 
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@v6

.github/workflows/pypi-test.yml

@@ -21,7 +21,7 @@ jobs:
         python-version: ["3.12"]
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v6.0.3
 
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@v6

.github/workflows/stale.yml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
     - name: "Check PRs"
-      uses: actions/stale@v10
+      uses: actions/stale@v10.3.0
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         stale-pr-message: 'This PR is stale because it has been open for 30 days with no activity.'

.github/workflows/unittest.yml

@@ -82,7 +82,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.3
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v6

docs/api/transliterate.rst

@@ -17,6 +17,9 @@ Modules
 
     The `transliterate` function serves as a versatile transliteration tool, offering a range of transliteration engines to choose from. It provides flexibility and customization for your transliteration needs.
 
+.. autofunction:: transliterate_wiktionary
+    :noindex:
+
 .. autofunction:: pronunciate
     :noindex:
 
@@ -30,6 +33,9 @@ Modules
 
     The `puan` function offers a unique transliteration feature known as "Puan." It provides a specialized transliteration method for Thai text and is an additional option for rendering Thai text into English characters.
 
+.. autofunction:: get_word_dict
+    :noindex:
+
 .. autoclass:: pythainlp.transliterate.wunsen.WunsenTransliterate
    :members:
 

pyproject.toml

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: 2016-2026 PyThaiNLP Project
+# SPDX-FileCopyrightText: 2016-present PyThaiNLP Project
 # SPDX-FileType: SOURCE
 # SPDX-License-Identifier: Apache-2.0
 
@@ -71,6 +71,7 @@ dependencies = [
 ## 1) Development ########################################
 
 dev = [
+    "bandit>=1.9.4",
     "black>=25.11.0",
     "build>=1.0.0",
     "bump-my-version>=1.2.6",
@@ -311,6 +312,11 @@ include = [
     "README.md",
 ]
 
+[tool.bandit]
+# Skip tests that produce known false positives or are accepted risks.
+# B110: Try/Except/Pass. Accepted pattern in optional-dependency loading.
+skips = ["B110"]
+
 [tool.bumpversion]
 current_version = "5.3.4"
 commit = true

pythainlp/augment/lm/phayathaibert.py

@@ -29,10 +29,10 @@ def __init__(self) -> None:
         )
 
         self.tokenizer: AutoTokenizer = AutoTokenizer.from_pretrained(
-            _MODEL_NAME
+            _MODEL_NAME  # nosec B615
         )
         self.model_for_masked_lm: AutoModelForMaskedLM = (
-            AutoModelForMaskedLM.from_pretrained(_MODEL_NAME)
+            AutoModelForMaskedLM.from_pretrained(_MODEL_NAME)  # nosec B615
         )
         self.model: Pipeline = pipeline(
             "fill-mask",
@@ -55,7 +55,7 @@ def generate(
             input_text = self.processor.preprocess(sample_txt)
             if sample:
                 # Non-cryptographic use, pseudo-random generator is acceptable here
-                random_word_idx = random.randint(0, 4)  # noqa: S311
+                random_word_idx = random.randint(0, 4)  # noqa: S311  # nosec B311  # NOSONAR
                 output = self.model(input_text)[random_word_idx]["sequence"]
             else:
                 output = self.model(input_text)[word_rank]["sequence"]

pythainlp/augment/lm/wangchanberta.py

@@ -29,7 +29,7 @@ def __init__(self) -> None:
         self.target_tokenizer: type[CamembertTokenizer] = CamembertTokenizer
         self.tokenizer: CamembertTokenizer = (
             CamembertTokenizer.from_pretrained(
-                self.model_name, revision="main"
+                self.model_name, revision="main"  # nosec B615
             )
         )
         self.tokenizer.additional_special_tokens = [

pythainlp/corpus/core.py

@@ -71,7 +71,7 @@ def get_corpus_db(url: str) -> Optional[_ResponseWrapper]:
     try:
         req = Request(url, headers={"User-Agent": _USER_AGENT})
         # SSL certificate verification is enabled by default
-        with urlopen(req, timeout=10) as response:
+        with urlopen(req, timeout=10) as response:  # nosec B310
             corpus_db = _ResponseWrapper(response)
     except HTTPError as http_err:
         print(f"HTTP error occurred: {http_err}")
@@ -349,7 +349,7 @@ def _download(url: str, dst: str) -> int:
 
     req = Request(url, headers={"User-Agent": _USER_AGENT})
     # SSL certificate verification is enabled by default
-    with urlopen(req, timeout=10) as response:
+    with urlopen(req, timeout=10) as response:  # nosec B310
         file_size = int(response.info().get("Content-Length", -1))
         with open(get_full_data_path(dst), "wb") as f:
             pbar = None
@@ -383,7 +383,7 @@ def _check_hash(dst: str, md5: str) -> None:
         with open(get_full_data_path(dst), "rb") as f:
             content = f.read()
             # MD5 is insecure but sufficient here
-            file_md5 = hashlib.md5(content).hexdigest()  # noqa: S324
+            file_md5 = hashlib.md5(content).hexdigest()  # noqa: S324  # nosec B324
 
             if md5 != file_md5:
                 raise ValueError("Hash does not match expected.")
@@ -484,7 +484,7 @@ def _safe_extract_tar(tar: tarfile.TarFile, path: str) -> None:
                             f"Symlink {member.name} points outside extraction directory: {member.linkname}"
                         )
 
-        tar.extractall(path=path)
+        tar.extractall(path=path)  # nosec B202
 
 
 def _safe_extract_zip(zip_file: zipfile.ZipFile, path: str) -> None:
@@ -539,7 +539,7 @@ def _safe_extract_zip(zip_file: zipfile.ZipFile, path: str) -> None:
                         f"Symlink {member} points outside extraction directory: {link_target}"
                     )
 
-    zip_file.extractall(path=path)
+    zip_file.extractall(path=path)  # nosec B202
 
 
 def _version2int(v: str) -> int:
@@ -853,12 +853,17 @@ def make_safe_directory_name(name: str) -> str:
     return safe_name
 
 
-def get_hf_hub(repo_id: str, filename: str = "") -> str:
+def get_hf_hub(
+    repo_id: str, filename: str = "", revision: Optional[str] = None
+) -> str:
     """HuggingFace Hub in :mod:`pythainlp` data directory.
 
     :param str repo_id: repo_id
     :param str filename: filename (optional, default is empty string).
         If empty, downloads entire snapshot.
+    :param Optional[str] revision: a git revision id, which can be a branch
+        name, a tag, or a commit hash (optional, default is ``None``).
+        Pin to a full commit hash for reproducible and secure downloads.
     :return: path
     :rtype: str
     """
@@ -876,10 +881,15 @@ def get_hf_hub(repo_id: str, filename: str = "") -> str:
     root_project = safe_path_join(hf_root, name_dir)
     if filename:
         output_path = hf_hub_download(
-            repo_id=repo_id, filename=filename, local_dir=root_project
+            repo_id=repo_id,
+            filename=filename,
+            local_dir=root_project,
+            revision=revision,
         )
     else:
         output_path = snapshot_download(
-            repo_id=repo_id, local_dir=root_project
+            repo_id=repo_id,
+            local_dir=root_project,
+            revision=revision,
         )
     return str(output_path)