Upstreaming from v5.3 (v5.3.5)

.github/workflows/bandit.yml

@@ -51,10 +51,10 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v6.2.0
         with:
           python-version: "3.x"
           cache: "pip"

.github/workflows/codemeta2cff.yml

@@ -25,7 +25,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@v7.0.0
 
       - name: Generate CITATION.cff from codemeta.json
         uses: caltechlibrary/codemeta2cff@99ce10831c3037a067c3d9551d455638e0b438ac  #v0.3.3
@@ -37,7 +37,7 @@ jobs:
           printf '\n```' >> $GITHUB_STEP_SUMMARY
 
       - name: Validate CITATION.cff
-        uses: dieghernan/cff-validator@54c8e737314b948f25c0e5524a9d8ae3f39b207b  #v5.0.1
+        uses: dieghernan/cff-validator@d8f85828214016ce6976e740b6e0504c0fdc4dbb  #v5.1.1
 
       - name: Commit and push updated CITATION.cff
         uses: EndBug/add-and-commit@290ea2c423ad77ca9c62ae0f5b224379612c0321  #v10.0.0

.github/workflows/codeql-analysis.yml

@@ -62,11 +62,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6.0.3
+      uses: actions/checkout@v7.0.0
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4.36.2
+      uses: github/codeql-action/init@v4.37.1
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -77,7 +77,7 @@ jobs:
     # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v4.36.2
+      uses: github/codeql-action/autobuild@v4.37.1
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -91,4 +91,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4.36.2
+      uses: github/codeql-action/analyze@v4.37.1

.github/workflows/corpus.yml

@@ -36,10 +36,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@v7.0.0
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v6.2.0
         with:
           python-version: "3.13"
           cache: "pip"

.github/workflows/deploy-docs.yml

@@ -24,9 +24,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v6.0.3
+      uses: actions/checkout@v7.0.0
     - name: Set up Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@v6.2.0
       with:
         python-version: "3.12"
     - name: Install build tools and doc build tools

.github/workflows/lint.yml

@@ -43,9 +43,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v6.0.3
+      uses: actions/checkout@v7.0.0
     - name: Ruff
-      uses: astral-sh/ruff-action@v3
+      uses: astral-sh/ruff-action@v4.1.0
       with:
         src: "./pythainlp ./tests ./examples"
         args: check --verbose --config pyproject.toml

.github/workflows/markdownlint.yml

@@ -24,11 +24,11 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 0
 
-      - uses: DavidAnson/markdownlint-cli2-action@v23.2.0
+      - uses: DavidAnson/markdownlint-cli2-action@v24.0.0
         with:
           globs: |
             **/*.md

.github/workflows/mypy.yml

@@ -46,10 +46,10 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@v7.0.0
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v6.2.0
         with:
           python-version: "3.9"
           cache: "pip"

.github/workflows/publish-versioned-docs.yml

@@ -31,26 +31,26 @@ jobs:
       run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
 
     - name: Checkout pythainlp (for scripts)
-      uses: actions/checkout@v6.0.3
+      uses: actions/checkout@v7.0.0
       with:
         path: pythainlp
 
     - name: Checkout dev-docs repository
-      uses: actions/checkout@v6.0.3
+      uses: actions/checkout@v7.0.0
       with:
         repository: PyThaiNLP/dev-docs
         token: ${{ secrets.PERSONAL_TOKEN }}
         path: dev-docs
 
     - name: Checkout docs repository
-      uses: actions/checkout@v6.0.3
+      uses: actions/checkout@v7.0.0
       with:
         repository: PyThaiNLP/docs
         token: ${{ secrets.PERSONAL_TOKEN }}
         path: docs
 
     - name: Set up Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@v6.2.0
       with:
         python-version: "3.12"
 

.github/workflows/pypi-publish.yml

@@ -52,7 +52,7 @@ jobs:
       build: ${{ steps.check_build_trigger.outputs.build }}
     steps:
     - name: Checkout source code
-      uses: actions/checkout@v6.0.3
+      uses: actions/checkout@v7.0.0
       with:
         ref: ${{ github.event.pull_request.head.sha }}
     - id: check_build_trigger
@@ -71,10 +71,10 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v6.0.3
+      uses: actions/checkout@v7.0.0
 
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@v6.2.0
       with:
         python-version: ${{ matrix.python-version }}
 
@@ -100,7 +100,7 @@ jobs:
     if: github.event_name == 'release' && github.event.action == 'published'
     steps:
     - name: Retrieve distributions
-      uses: actions/download-artifact@v7
+      uses: actions/download-artifact@v8
       with:
         name: artifact
         path: dist

.github/workflows/pypi-test.yml

@@ -21,10 +21,10 @@ jobs:
         python-version: ["3.12"]
 
     steps:
-    - uses: actions/checkout@v6.0.3
+    - uses: actions/checkout@v7.0.0
 
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@v6.2.0
       with:
         python-version: ${{ matrix.python-version }}
         cache: "pip"

.github/workflows/stale.yml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
     - name: "Check PRs"
-      uses: actions/stale@v10.3.0
+      uses: actions/stale@v10.4.0
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         stale-pr-message: 'This PR is stale because it has been open for 30 days with no activity.'

.github/workflows/unittest.yml

@@ -82,10 +82,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@v7.0.0
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
           cache: "pip"

CHANGELOG.md

@@ -23,6 +23,15 @@ and this project adheres to
 
 - Improve guardrails in `check_sara()` and `nighit()`
 
+## [5.3.5] - 2026-07-30
+
+### Fixed
+
+- Change loop limit from 20 to dec_maxlen #1464
+- fix: remove duplicate .replace mid-tone in _clean_ipa #1409
+- Fix: CodeQL ReDoS vulnerability in ULMFiT replace_url #1400
+- fix: remove unconditional overwrite that disables teacher forcing in Seq2Seq #1380
+
 ## [5.3.4] - 2026-04-02
 
 ### Fixed
@@ -308,6 +317,7 @@ The minimum requirement is now Python 3.9.
 
 - See <https://github.com/PyThaiNLP/pythainlp/releases/tag/v5.0.0>
 
+[5.3.5]: https://github.com/PyThaiNLP/pythainlp/compare/v5.3.5...v5.3.5
 [5.3.4]: https://github.com/PyThaiNLP/pythainlp/compare/v5.3.3...v5.3.4
 [5.3.3]: https://github.com/PyThaiNLP/pythainlp/compare/v5.3.2...v5.3.3
 [5.3.2]: https://github.com/PyThaiNLP/pythainlp/compare/v5.3.1...v5.3.2

CITATION.cff

@@ -24,7 +24,7 @@ abstract: PyThaiNLP is a Thai natural language processing library for Python. It
 repository-code: "https://github.com/PyThaiNLP/pythainlp"
 type: software
 doi: 10.5281/zenodo.3519354
-version: 5.3.4
+version: 5.3.5
 license-url: "https://spdx.org/licenses/Apache-2.0"
 keywords:
   - computational linguistics

README.md

@@ -31,8 +31,8 @@ pip install pythainlp
 
 | Version | Python version | Changes | Documentation |
 |:-------:|:--------------:|:-------:|:-------------:|
-| [5.3.4](https://github.com/PyThaiNLP/pythainlp/releases) | 3.9+ | [Log](https://github.com/PyThaiNLP/pythainlp/blob/dev/CHANGELOG.md#533---2026-03-26) | [pythainlp.org/docs](https://pythainlp.org/docs) |
-| [`dev`](https://github.com/PyThaiNLP/pythainlp/tree/dev) | 3.9+ | [Log](https://github.com/PyThaiNLP/pythainlp/compare/v5.3.4...HEAD) | [pythainlp.org/dev-docs](https://pythainlp.org/dev-docs/) |
+| [5.3.5](https://github.com/PyThaiNLP/pythainlp/releases) | 3.9+ | [Log](https://github.com/PyThaiNLP/pythainlp/blob/dev/CHANGELOG.md) | [pythainlp.org/docs](https://pythainlp.org/docs) |
+| [`dev`](https://github.com/PyThaiNLP/pythainlp/tree/dev) | 3.9+ | [Log](https://github.com/PyThaiNLP/pythainlp/compare/v5.3.5...HEAD) | [pythainlp.org/dev-docs](https://pythainlp.org/dev-docs/) |
 
 ## Features
 

README_TH.md

@@ -29,8 +29,8 @@ pip install pythainlp
 
 | รุ่น | รุ่นของ Python | มีอะไรเปลี่ยน | เอกสาร |
 | :-: | :-: | :-: | :-: |
-| [5.3.4](https://github.com/PyThaiNLP/pythainlp/releases) | 3.9+ | [Log](https://github.com/PyThaiNLP/pythainlp/blob/dev/CHANGELOG.md#533---2026-03-26) | [pythainlp.org/docs](https://pythainlp.org/docs) |
-| [`dev`](https://github.com/PyThaiNLP/pythainlp/tree/dev) | 3.9+ | [Log](https://github.com/PyThaiNLP/pythainlp/compare/v5.3.4...HEAD) | [pythainlp.org/dev-docs](https://pythainlp.org/dev-docs/) |
+| [5.3.5](https://github.com/PyThaiNLP/pythainlp/releases) | 3.9+ | [Log](https://github.com/PyThaiNLP/pythainlp/blob/dev/CHANGELOG.md) | [pythainlp.org/docs](https://pythainlp.org/docs) |
+| [`dev`](https://github.com/PyThaiNLP/pythainlp/tree/dev) | 3.9+ | [Log](https://github.com/PyThaiNLP/pythainlp/compare/v5.3.5...HEAD) | [pythainlp.org/dev-docs](https://pythainlp.org/dev-docs/) |
 
 ## ความสามารถ
 

codemeta.json

@@ -197,5 +197,5 @@
         "https://pythainlp.org/Model-Cards/"
     ],
     "url": "https://pythainlp.org/",
-    "version": "5.3.4"
+    "version": "5.3.5"
 }

pyproject.toml

@@ -8,7 +8,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pythainlp"
-version = "5.3.4"
+version = "5.3.5"
 description = "Thai Natural Language Processing library"
 readme = "README.md"
 requires-python = ">=3.9"
@@ -269,16 +269,16 @@ full = [
     "PyYAML>=5.4.1,<6.0.2",
     "sacremoses==0.1.1",
     "sentence-transformers>=2.7.0,<3",
-    "sentencepiece==0.2.1",
+    "sentencepiece==0.2.2",
     "spacy==3.8.7,<4",
     "spacy_thai==0.7.8",
     "ssg==0.0.8",
     "sefr_cut>=1.1",
-    "symspellpy==6.9.0",
+    "symspellpy==6.10.0",
     "thai-nner==0.3",
     "tltk>=1.10,<2",
     "torch>=1.13.1,<3",
-    "transformers==4.57.6",
+    "transformers==5.14.1",
     "ufal.chu-liu-edmonds==1.0.3",
     "word2word>=1.0.0,<2",
     "wtpsplit==1.3.0",
@@ -315,7 +315,7 @@ include = [
 skips = ["B110"]
 
 [tool.bumpversion]
-current_version = "5.3.4"
+current_version = "5.3.5"
 commit = true
 tag = true
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)(\\-(?P<release>[a-z]+)(?P<build>\\d+))?"

pythainlp/__init__.py

@@ -1,7 +1,7 @@
 # SPDX-FileCopyrightText: 2016-2026 PyThaiNLP Project
 # SPDX-FileType: SOURCE
 # SPDX-License-Identifier: Apache-2.0
-__version__ = "5.3.4"
+__version__ = "5.3.5"
 
 thai_consonants: str = (
     "กขฃคฅฆงจฉชซฌญฎฏฐฑฒณดตถทธนบปผฝพฟภมยรลวศษสหฬอฮ"  # 44 chars

pythainlp/transliterate/w2p.py

@@ -294,7 +294,7 @@ def _predict(self, word: str) -> str:
         h = last_hidden
 
         preds: list[int] = []
-        for _ in range(20):
+        for _ in range(hp.dec_maxlen):
             h = self._grucell(
                 dec,
                 h,