chore(deps): bump nltk from 3.9.4 to 3.10.0 in /envs/textarena_env - #1031
chore(deps): bump nltk from 3.9.4 to 3.10.0 in /envs/textarena_env#1031dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [nltk](https://github.com/nltk/nltk) from 3.9.4 to 3.10.0. - [Release notes](https://github.com/nltk/nltk/releases) - [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog) - [Commits](nltk/nltk@3.9.4...v3.10.0) --- updated-dependencies: - dependency-name: nltk dependency-version: 3.10.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
Automated dependency-bump review of nltk 3.9.3/3.9.4 → 3.10.0 in envs/textarena_env (two-tier model). Verdict: clean, security-positive, safe to merge from an alignment standpoint.
Automated Checks
- Lint: PASS (for this PR). The diff touches only
pyproject.toml+uv.lock(no Python files), so the Python-only lint pipeline has nothing to check..claude/hooks/lint.shdoes exit non-zero, but every flagged path is pre-existing format drift in unrelated envs (opencode_env,pi_env,coding_tools_env, …) — none are in this PR.uv lock --checkonenvs/textarena_envpasses (127 packages resolved). - Debug code: CLEAN.
check-debug.shscanssrc/only; this PR touchesenvs/textarena_env/exclusively, and all hook hits are pre-existing docstring/CLI examples.
Verification (all pass)
- Direct dep, consistent bump:
nltkis a direct dep of textarena_env, so dependabot correctly updated both the pyproject floor and the lockrequires-distto>=3.10.0, matching the resolved3.10.0. - Hashes match PyPI exactly for nltk 3.10.0 (wheel + sdist) and the newly-added
defusedxml 0.7.1(wheel + sdist); allyanked=false. - Constraints satisfied: nltk 3.10.0
requires-python >=3.10== env's>=3.10;defusedxmlhas no deps and is Python-compatible. - Security-positive: nltk 3.9.4 carried 4 known advisories; 3.10.0 reports 0. CVE-2026-12075, CVE-2026-12061, and CVE-2026-12074 all list
fixed_in: 3.10.0. - Born-clean lock: no index-source flip (0 HF-mirror refs on either side), no revision bump (already
revision = 3), no unrelatedrequires-distre-sync.origin/main== PR base, clean merge. - API compatibility: textarena_env only calls
nltk.download("words")/nltk.download("averaged_perceptron_tagger_eng")(server/environment.py) — stable API, and_engis already the current post-3.9 tagger name. Unaffected by 3.10.0.
Open RFCs Context
Open RFCs are 000/001/002/003/005 (In Review), 010 (Draft), and 004 (no status header). None govern packaging or dependency management, so none are relevant to this bump.
Tier 1: Fixes Required
None.
Tier 2: Alignment Discussion
Principle Conflicts: None identified. No public API, reward, client-server, or MCP/WebSocket surface is touched; the change respects the "cutting-edge for stability" trade-off (a stable minor bump that also clears CVEs).
RFC Conflicts: None identified.
Process note (non-blocking): .github/dependabot.yml configures the uv updater with directory: "/" + exclude-paths: ["envs/**"] (lines 8-9), yet this native dependabot/uv/envs/textarena_env/… PR modifies envs/textarena_env/**. The uv ecosystem does not appear to honor exclude-paths (a known platform limitation seen on prior env dependabot PRs); the intended path for env bumps is the aggregate codex/dependabot-envs-* roll-ups. Not a blocker for this PR. cc @burtenshaw
Summary
- 0 mechanical issues to fix
- 0 alignment points for human review
- 0 RFC conflicts
- 1 non-blocking process observation (native env dependabot PR vs
exclude-paths)
Reviewers for context: @Darktex (security/reproducibility), @burtenshaw (dependabot config).
Sent by Cursor Automation: Pre-review
| # "smolagents>=1.22.0,<2", | ||
| "textarena>=0.6.1", | ||
| "nltk>=3.9.3", | ||
| "nltk>=3.10.0", |
There was a problem hiding this comment.
nltk is a direct dependency here, so dependabot correctly bumps both this floor and the lock's requires-dist (uv.lock:1666) to >=3.10.0, matching the resolved 3.10.0. uv lock --check passes, and textarena_env's requires-python >=3.10 matches nltk 3.10.0's requires-python >=3.10.
| [[package]] | ||
| name = "nltk" | ||
| version = "3.9.4" | ||
| version = "3.10.0" |
There was a problem hiding this comment.
Verified against PyPI: nltk 3.10.0 wheel sha256:54ff84d4…244bf (size 1716144) and sdist sha256:4fbac1d9…e8c1 (size 3089244) match this lock; both yanked=false.
Security-positive: nltk 3.9.4 carried 4 advisories, and 3.10.0 reports 0 — CVE-2026-12075, CVE-2026-12061, and CVE-2026-12074 all list fixed_in: 3.10.0.
| ] | ||
|
|
||
| [[package]] | ||
| name = "defusedxml" |
There was a problem hiding this comment.
This new defusedxml 0.7.1 block is expected: nltk 3.10.0 adds defusedxml to its runtime dependencies (3.9.4 did not), wired into nltk's deps at uv.lock:1419. Hashes match PyPI (wheel sha256:a352e7e4…8a61, sdist sha256:1bb3032d…3e69), yanked=false, and it has no transitive deps of its own.
It's a security-hardening dependency (defuses XML parsing against XXE / entity-expansion in nltk's corpus readers), so this is a net-positive addition.
1 participant
Bumps nltk from 3.9.4 to 3.10.0.
Release notes
Sourced from nltk's releases.
... (truncated)
Changelog
Sourced from nltk's changelog.
... (truncated)
Commits
bd49f90allow escaped brackets in Tree.fromstring (#3694)27b8ad6don't crash chomsky_normal_form on terminals with siblings (#3693)52227d2Use os.name for Windows path handling (#3605)06c0e2cAvoid RIBES zero division on empty inputs (#3604)a167389Treat missing unzip output as stale (#3607)c94c967Fix EOF empty document bug in IEER corpus reader (#3648)94a259cEnforce restrictive primitive type checking in pathsec wrappers (#3692)5ac475dfix(security): isolate Stanford Java options and clean temp files (#3683)986f26eci(deps): bump the github-actions group with 3 updates (#3691)f26b375fix(security): prevent pickle RCE in TransitionParser model loading (CWE-502)...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Dependency-only change with no code edits; NLTK 3.10 tightens default resource-loading security, which could affect
nltk.downloadbehavior but is unlikely to break the existing quiet downloads.Overview
Bumps NLTK from
3.9.4to3.10.0inenvs/textarena_envby updatingpyproject.toml(nltk>=3.10.0) and refreshinguv.lock.The lockfile also picks up
defusedxmlas a new transitive dependency required by NLTK 3.10. No application code changes; the env still uses NLTK for optional corpus downloads (e.g.words, taggers) at runtime.Reviewed by Cursor Bugbot for commit 3d7aa74. Bugbot is set up for automated code reviews on this repo. Configure here.