[dependabot]

Bumps the python-minor-patch group with 7 updates in the / directory:

Package	From	To
openai	3.35.1	3.39.0
langchain-core	1.6.12	1.7.0
langchain-openai	1.7.2	1.7.3
nltk	3.10.3	3.10.4
sentry-sdk	2.72.0	2.73.0
pandas	3.0.6	3.1.0
ruff	0.17.1	0.17.3

Updates openai from 3.35.1 to 3.39.0

Release notes

Sourced from openai's releases.

v3.39.0

3.39.0 (2026-10-26)

Features

• api: add gpt-6.1-terra model identifier (#4180) (e8beb1a)

v3.38.0

3.38.0 (2026-10-25)

Features

• api: add delegation controls and prompt cache lifetimes (#4169) (43045fc)
• api: expand Live Decision item and question types (#4175) (5d72315)

Bug Fixes

• agents: clarify result schema warnings (#4165) (cfa0a79)
• format API status errors using the server message (#4161) (6ce5f05)
• preserve fallback parsing for PEP 604 unions (#4160) (05dfea0)
• responses: resolve function arguments within their namespace (#4166) (81792ff)
• responses: validate tool namespaces before runner dispatch (#4167) (56a55f2)

Chores

• api: preserve client and resource compatibility (#4157) (56f33a1)
• enforce zero custom code in generated Python files (#4168) (d622f28)

v3.37.0

3.37.0 (2026-10-22)

⚠ BREAKING CHANGES

• api: This minor release includes a breaking change to Decisions types. In Live response models, question instructions can now be a string or a list of structured text, image, or JSON parts; check isinstance(question.instructions, str) before using string operations and handle the structured form. Decisions request input types also include additional message roles and tool-history items, so update exhaustive type checks accordingly. Existing string instructions and DecisionInputMessageParam user-message inputs remain supported.

Features

• api: expand Decisions input and question types (#4158) (1e45ad1)

Chores

• api: preserve file and video polling helpers (#4155) (7db9d88)
• api: preserve upload helpers and Live connection defaults (#4152) (a29dc39)

... (truncated)

Changelog

Sourced from openai's changelog.

3.39.0 (2026-10-26)

Features

• api: add gpt-6.1-terra model identifier (#4180) (e8beb1a)

3.38.0 (2026-10-25)

Features

• api: add delegation controls and prompt cache lifetimes (#4169) (43045fc)
• api: expand Live Decision item and question types (#4175) (5d72315)

Bug Fixes

• agents: clarify result schema warnings (#4165) (cfa0a79)
• format API status errors using the server message (#4161) (6ce5f05)
• preserve fallback parsing for PEP 604 unions (#4160) (05dfea0)
• responses: resolve function arguments within their namespace (#4166) (81792ff)
• responses: validate tool namespaces before runner dispatch (#4167) (56a55f2)

Chores

• api: preserve client and resource compatibility (#4157) (56f33a1)
• enforce zero custom code in generated Python files (#4168) (d622f28)

3.37.0 (2026-10-22)

⚠ BREAKING CHANGES

• api: This minor release includes a breaking change to Decisions types. In Live response models, question instructions can now be a string or a list of structured text, image, or JSON parts; check isinstance(question.instructions, str) before using string operations and handle the structured form. Decisions request input types also include additional message roles and tool-history items, so update exhaustive type checks accordingly. Existing string instructions and DecisionInputMessageParam user-message inputs remain supported.

Features

• api: expand Decisions input and question types (#4158) (1e45ad1)

Chores

• api: preserve file and video polling helpers (#4155) (7db9d88)
• api: preserve upload helpers and Live connection defaults (#4152) (a29dc39)
• deps: bump astral-sh/setup-uv from 10.2.0 to 10.3.0 (#4109) (fa9a161)

3.36.1 (2026-10-22)

... (truncated)

Commits

• f97798b release: 3.39.0 (#4181)
• e8beb1a feat(api): add gpt-6.1-terra model identifier (#4180)
• c22202e test: remove duplicate client tests and fix base URL coverage (#4170)
• 9f8d65b test(agents): avoid repeating every stream delta (#4171)
• 86ace15 test: batch fractional transcript deadline cases (#4173)
• a93b62c release: 3.38.0 (#4162)
• 5d72315 feat(api): expand Live Decision item and question types (#4175)
• 718aee9 Use UTF-8 when reading Bedrock test fixtures (#3530)
• 43045fc feat(api): add delegation controls and prompt cache lifetimes (#4169)
• d622f28 chore: enforce zero custom code in generated Python files (#4168)
• Additional commits viewable in compare view

Updates langchain-core from 1.6.12 to 1.7.0

Release notes

Sourced from langchain-core's releases.

langchain-core==1.7.0

Changes since langchain-core==1.6.13

release(core): 1.7.0 (#41418) feat(core): emit tool-call-delta for streamed tool-call args (#41257)

Notes

• Tool-call args now stream as tool-call-delta slices instead of block-delta snapshots of the args so far. If you read raw stream events and their block-delta args mid-stream, read tool-call-delta instead. .tool_calls.get() and .output are unchanged. To keep snapshots, pin langchain-core<1.7.
• Since 1.6.13, iterating ChatModelStream.tool_calls yields each call's new args slice, not a snapshot of the args so far.

langchain-core==1.6.13

Changes since langchain-core==1.6.12

release(core): 1.6.13 (#41397) chore(deps): bump certifi from 2025.11.12 to 2026.10.19 in /libs/core (#41373) feat(core,langchain,standard-tests): read tool-call-delta in stream consumers (#41246)

Commits

• f4e6cde release(core): 1.7.0 (#41418)
• 1013180 docs: update OpenWiki (#41416)
• 64ecb6a chore(model-profiles): refresh model profile data (#41415)
• b84fa61 feat(core): emit tool-call-delta for streamed tool-call args (#41257)
• 6908e67 chore(deps): bump uv to 0.13.5 (#41408)
• 8eff3b3 docs: update OpenWiki (#41356)
• 45dae8c chore(deps): bump aiohttp from 3.14.4 to 3.14.5 in /libs/partners/openai (#41...
• 150d2cb chore(deps): bump aiohttp from 3.14.4 to 3.14.5 in /libs/partners/huggingface...
• de1cc39 chore(deps): bump setuptools from 84.2.0 to 84.2.1 in /libs/partners/huggingf...
• fbb8a35 chore(langchain): update lockfile (#41402)
• Additional commits viewable in compare view

Updates langchain-openai from 1.7.2 to 1.7.3

Release notes

Sourced from langchain-openai's releases.

langchain-openai==1.7.3

Changes since langchain-openai==1.7.2

test(openai): use current lightweight model in integration tests (#41509) release(openai): 1.7.3 (#41506) chore(model-profiles): refresh openai model profile data (#41505) build(infra): patch test-only Pillow without dropping Python 3.10 (#41484) revert: patch vulnerable integration dependencies (#41481) build(deps): patch vulnerable integration dependencies (#41473) chore(infra): relax third-party dependency upper bounds (#41407) chore(deps): bump aiohttp from 3.14.4 to 3.14.5 in /libs/partners/openai (#41379) chore(deps): bump certifi from 2025.10.5 to 2026.10.19 in /libs/partners/openai (#41380) chore(deps): bump aiohttp from 3.14.3 to 3.14.4 in /libs/partners/openai (#41362) chore(model-profiles): refresh model profile data (#41325) chore(deps): bump pytest from 9.0.3 to 9.1.1 in /libs/partners/openai (#41328) chore(deps): bump pygments from 2.20.0 to 2.21.0 in /libs/partners/openai (#41333) chore(deps): bump requests from 2.33.0 to 2.34.2 in /libs/partners/openai (#41331) chore(deps): bump orjson from 3.11.6 to 3.13.0 in /libs/partners/openai (#41329) fix: fix dependencies in some partner packages (#41266)

Commits

• 575db57 test(openai): use current lightweight model in integration tests (#41509)
• 0d29456 release(openai): 1.7.3 (#41506)
• 8635846 chore(model-profiles): refresh openai model profile data (#41505)
• 0c09d02 chore(deps): bump the minor-and-patch group across 3 directories with 32 upda...
• 621a915 ci(infra): harden release workflow against supply-chain tampering (#41489)
• b2f6837 docs: update OpenWiki (#41497)
• 7b8bc18 chore(model-profiles): refresh model profile data (#41494)
• d57f1ea build(infra): avoid vulnerable filelock releases without dropping compatibili...
• 2cc234c ci(infra): run matrix regression tests before generating jobs (#41487)
• 28ec094 build(infra): patch test-only Pillow without dropping Python 3.10 (#41484)
• Additional commits viewable in compare view

Updates nltk from 3.10.3 to 3.10.4

Release notes

Sourced from nltk's releases.

v3.10.4

Version 3.10.4 2026-10-20

This release routes every file path, archive, download, URL fetch and external program through one sandbox that keeps reads and writes inside the trusted data directories, refuses path traversal, symlink escapes and decompression bombs, blocks requests to internal network addresses, and runs Java and other third-party tools only from trusted absolute locations with validated options and input. Pickled models now load through a restricted unpickler, XML and JSON parsing are hardened, and regular expressions, recursion and slow algorithms in the tokenizers, parsers, stemmers and corpus readers are bounded against denial-of-service input. Text that NLTK writes to the terminal, to CSV files, to the WordNet browser and to third-party tool input is sanitized against injection.

Security changes you may notice

Every refusal below raises with a message that starts with "Security Violation" and names the check, so a failure is easy to search for (PR #3877).

• Data directories (nltk.pathsec, nltk.data): corpora, models and every other resource are read and written only inside the directories listed in nltk.data.path. A path that leaves a data root, a symlink that points out of one, and a NUL byte or encoded traversal in a resource name are refused. A data root, or a directory on the way to a resource, that another account can write to is skipped with a warning naming the directory and the remedy. Keep private data in a private directory and add it to nltk.data.path; /tmp is not a data root. Model save and load methods (perceptron, maxent, named-entity chunker, Weka, crf, hunpos, Stanford) accept destinations inside a data root only (PR #3797, #3753, #3850, #3761, #3755, #3759, #3760, #3763, #3806, #3807, #3808, #3809, #3813, #3814, #3815, #3848, #3851, #3852, #3853, #3863, #3871, #3888, #3945, #3961, #3969, #3981)
• Downloader: downloaded package archives stay private to the installing account (0600). An install another account must read is extracted: a download made as root or outside the installing account's home extracts on its own, and nltk.download(..., extract=True) / python -m nltk.downloader --extract (or --no-extract) decide explicitly. This also unpacks the packages the index leaves zipped (wordnet, omw-1.4 ...); the extracted files are readable by every account and are found before the archive. find() names an archive it cannot read and says how to extract it instead of reporting it "not found". The downloader installs only into directories no other account can write to, treats an archive another account owns or can write to as stale and downloads it afresh, extracts only from an archive no other account could have changed since its checksum was verified, bounds the size of what it fetches, and refuses index entries and archive members that would write outside the package directory (PR #3929, #3804, #3850, #3778)
• Pickles: nltk.data.load(..., format="pickle") reconstructs plain data only; a pickle that names any class or function is refused. Model loaders that need classes use an explicit allowlist of audited globals, so a gadget such as os.system can never be reconstructed from a model file. chat80 shelve values load the same way (PR #3794, #3754, #3757, #3802, #3817, #3823, #3824)
• XML, JSON and YAML: nltk.xmlsec refuses any document that declares an entity or references an external one (billion-laughs, external-entity and DTD attacks) and bounds the tree depth, and every corpus XML view, the downloader index, Toolbox and internals parse through it. JSON resources load with a depth and size bound; YAML (the markdown corpus front matter and nltk.data.load(..., format="yaml")) loads through a bounded safe loader. Oversized or too deeply nested input raises ValueError naming the limit (PR #3754, #3805, #3828, #3933, #3972, #3974)
• Regular expressions (nltk.redos): every regular expression NLTK compiles, including one you pass to RegexpTokenizer, RegexpStemmer, RegexpParser, re_show, TokenSearcher.findall, tgrep, nltk.help tag-set lookups and the concordance and nemo GUIs, now goes through nltk.redos on the regex engine. A pattern longer than 100,000 characters, nested more than 100 deep, with more than 1,000 capturing groups or an excessive repetition product is refused with nltk.redos.error, a subclass of re.error; a match that runs longer than nltk.redos.DEFAULT_TIMEOUT (5 seconds) raises TimeoutError instead of hanging. Patterns keep re syntax; match objects are the regex engine's (PR #3825, #3829, #3830, #3831, #3832, #3833, #3834, #3835, #3836, #3837, #3838, #3839, #3840, #3841, #3842, #3843, #3844, #3845, #3846, #3796, #3801, #3906, #3907, #3908, #3910)
• Regular expressions made linear: the leading-run and re-anchoring patterns that a timeout cannot catch were rewritten or bounded in the word, Treebank, blankline, TextTiling, toktok and syllable tokenizers, the readline of corpus streams, the CoNLL SRL, TIMIT, senseval, pl196x, NKJP, Alpino, YCOE, IEER, ACE, VerbNet, reviews and Lin readers, relextract, the valuation parser, the CCG lexicon parser, dependency grammars and chomsky_normal_form, each verified on the real corpus (PR #3947, #3934, #3932, #3938, #3935, #3933, #3869, #3944, #3911, #3909, #3953, #3895)
• Size, depth and time bounds: trees deeper than nltk.tree.MAX_TREE_DEPTH (500), WordNet and other relation walks deeper than nltk.util.MAX_RECURSION_DEPTH (500), tgrep deeper than 50, Toolbox deeper than 500, dependency graphs deeper than 200, are refused with ValueError naming the limit rather than exhausting the stack, and the stemmers, distance metrics, skipgrams, parsers and grammar transforms run in linear or bounded time with identical output for legitimate input. chart_parse stops after nltk.parse.chart.DEFAULT_MAX_TIME (5 seconds of wall-clock, needed only for feature grammars; max_time=None disables it). Tree.repr no longer recurses, so a deep accepted tree prints (PR #3827, #3885, #3895, #3767, #3784, #3917, #3958, #3960, #3977)
• External tools and Java: a tool binary is resolved from an absolute path or a trusted search path only, never from the current directory; the binary, its directory and the model and data files handed to it must not be writable by another account (symlinked and multi-call executables such as a packaged Graphviz dot are supported). java() accepts a main class as the first argument only (no -jar, @​argfile or .java source file), validates its options against an allowlist, and loads jars only from a data root unless NLTK_ALLOW_UNSAFE_JARS=1 opts out with a warning. CoreNLP server options are allowlisted. Stanford, Malt, Senna, hunpos, Prover9, megam, TADM, Weka and crf wrappers validate their paths and the text they pipe to the tool against line and argument injection (PR #3772, #3771, #3975, #3743, #3782, #3788, #3768, #3798, #3887, #3858, #3950, #3951, #3812, #3816, #3868, #3894, #3941, #3850, #3925)
• Network: the downloader, nltk.data.load of a URL and the CHILDES reader fetch through pathsec.urlopen, which refuses addresses that are not globally routable (loopback, private, link-local and multicast, including tunnelled and obfuscated forms), pins the validated address for the connection, allows file:// with a local authority only, and refuses a proxied fetch unless NLTK_ALLOW_PROXIED_URLOPEN=1 (or nltk.pathsec.ALLOW_PROXIED_FETCH = True) asserts the proxy is trusted. The CoreNLP client talks to its local server with requests and is not affected (PR #3847, #3810, #3750, #3850)
• Terminal, CSV, DOT and HTML output: every print in the library goes through nltk.termsec.safe_print, which renders control characters, escape sequences and unbalanced bidi overrides from corpus text as visible \xNN escapes instead of letting them reach the terminal. The CSV files the twitter and sentiment helpers write neutralise formula-leading and control-sequence cells, AlignedSent DOT labels are escaped, the WordNet browser escapes corpus text, and nltk.data.load's verbose output no longer prints the full resource URL (PR #3914, #3915, #3937, #3946, #3931, #3930, #3856, #3902)
• Corpus stores and encodings: the PanLex Lite and chat80 sqlite stores open read-only on a pinned descriptor with their schema screened and a statement step budget, chat80 shelves are read by a key manifest, Toolbox SFM markers are sanitised, and a resource encoding that is not a text codec (bz2_codec and friends) is refused (PR #3961, #3964, #3959, #3888, #3800, #3962)
• Package contents: the wheel no longer ships nltk.test.unit (the attack harnesses, advisory probes and their fixtures), so pip install nltk is about half the size and import nltk.test.unit works from a source checkout or the sdist only. The doctests under nltk.test still ship (PR #3954)

Security test and CI infrastructure

• Attack and regression harnesses, advisory probes, the sandbox conftest fixtures, the pre-commit guards (no unsandboxed open, every regex through redos, every pickle through picklesec, every print through safe_print), load-invariant CPU-time timing rules, CI matrix and runner fixes, pinned third-party downloads, and the AUTHORS update (PR #3744, #3749, #3762, #3764, #3770, #3776, #3791, #3795, #3803, #3818, #3820, #3821, #3822, #3849, #3855, #3860, #3861, #3862, #3864, #3865, #3866, #3876, #3884, #3899, #3904, #3905, #3912, #3917, #3924, #3926, #3927, #3939, #3940, #3943, #3948, #3949, #3963, #3968, #3971, #3976, #3982, #3983, #3984, #3985)

Other changes

• Added RTL language syntactic tree visualization support (PR #3472)
• Fix #3394: Ensure punkt_tab is downloaded when punkt is requested (PR #3505)
• Show README.md as the PyPI long description (PR #3746)
• Add stopwords.words("english-extended") (PR #3747)
• Krippendorff's alpha: treat placeholder labels as missing data (#2865, #2732) (PR #3752)
• Fix shared defaults in chat80 Concept (PR #3773)
• Fix Java wrappers decoding str output from java() (universal_newlines) (PR #3777)
• Prevent IndexError in Hungarian stemmer on empty string (PR #3785)
• Isolate MTE tag filters per view (PR #3792)
• Fix newline in ellipsis tokens in TweetTokenizer (PR #3819)
• Isolate default WordNet reference relations (PR #3872)
• Fix resolution paths that cancel distinct literals (PR #3878)
• Fix UTF-8 text preprocessing in NKJP corpus reader (PR #3879)
• Remove shadowed FeatStruct._walk stub and preserve its docstring (PR #3893)
• Count all increasing pairs in RIBES kendall_tau (PR #3900)
• Fix the TweetTokenizer ZWJ emoji pattern capturing adjacent whitespace (PR #3913)
• Surface the CoreNLP server's reason for a non-2xx answer (PR #3942)
• Omit unaligned (NULL target) pairs from Alignment strings, so IBM model output prints (PR #3967)
• Fix DependencyGraph cycle detection, which returned False on every parsed graph (PR #3978)
• Show, range and draw an alignment with an unaligned pair on every surface (PR #3987)

Thanks to the following contributors to 3.10.4: Zhewen Tan, Yanhaoxi, Yazan Balawneh (Cystack.ps),

... (truncated)

Changelog

Sourced from nltk's changelog.

Version 3.10.4 2026-10-20

This release routes every file path, archive, download, URL fetch and external program through one sandbox that keeps reads and writes inside the trusted data directories, refuses path traversal, symlink escapes and decompression bombs, blocks requests to internal network addresses, and runs Java and other third-party tools only from trusted absolute locations with validated options and input. Pickled models now load through a restricted unpickler, XML and JSON parsing are hardened, and regular expressions, recursion and slow algorithms in the tokenizers, parsers, stemmers and corpus readers are bounded against denial-of-service input. Text that NLTK writes to the terminal, to CSV files, to the WordNet browser and to third-party tool input is sanitized against injection.

Security changes you may notice

Every refusal below raises with a message that starts with "Security Violation" and names the check, so a failure is easy to search for (PR #3877).

• Data directories (nltk.pathsec, nltk.data): corpora, models and every other resource are read and written only inside the directories listed in nltk.data.path. A path that leaves a data root, a symlink that points out of one, and a NUL byte or encoded traversal in a resource name are refused. A data root, or a directory on the way to a resource, that another account can write to is skipped with a warning naming the directory and the remedy. Keep private data in a private directory and add it to nltk.data.path; /tmp is not a data root. Model save and load methods (perceptron, maxent, named-entity chunker, Weka, crf, hunpos, Stanford) accept destinations inside a data root only (PR #3797, #3753, #3850, #3761, #3755, #3759, #3760, #3763, #3806, #3807, #3808, #3809, #3813, #3814, #3815, #3848, #3851, #3852, #3853, #3863, #3871, #3888, #3945, #3961, #3969, #3981)
• Downloader: downloaded package archives stay private to the installing account (0600). An install another account must read is extracted: a download made as root or outside the installing account's home extracts on its own, and nltk.download(..., extract=True) / python -m nltk.downloader --extract (or --no-extract) decide explicitly. This also unpacks the packages the index leaves zipped (wordnet, omw-1.4 ...); the extracted files are readable by every account and are found before the archive. find() names an archive it cannot read and says how to extract it instead of reporting it "not found". The downloader installs only into directories no other account can write to, treats an archive another account owns or can write to as stale and downloads it afresh, extracts only from an archive no other account could have changed since its checksum was verified, bounds the size of what it fetches, and refuses index entries and archive members that would write outside the package directory (PR #3929, #3804, #3850, #3778)
• Pickles: nltk.data.load(..., format="pickle") reconstructs plain data only; a pickle that names any class or function is refused. Model loaders that need classes use an explicit allowlist of audited globals, so a gadget such as os.system can never be reconstructed from a model file. chat80 shelve values load the same way (PR #3794, #3754, #3757, #3802, #3817, #3823, #3824)
• XML, JSON and YAML: nltk.xmlsec refuses any document that declares an entity or references an external one (billion-laughs, external-entity and DTD attacks) and bounds the tree depth, and every corpus XML view, the downloader index, Toolbox and internals parse through it. JSON resources load with a depth and size bound; YAML (the markdown corpus front matter and nltk.data.load(..., format="yaml")) loads through a bounded safe loader. Oversized or too deeply nested input raises ValueError naming the limit (PR #3754, #3805, #3828, #3933, #3972, #3974)
• Regular expressions (nltk.redos): every regular expression NLTK compiles, including one you pass to RegexpTokenizer, RegexpStemmer, RegexpParser, re_show, TokenSearcher.findall, tgrep, nltk.help tag-set lookups and the concordance and nemo GUIs, now goes through nltk.redos on the regex engine. A pattern longer than 100,000 characters, nested more than 100 deep, with more than 1,000 capturing groups or an excessive repetition product is refused with nltk.redos.error, a subclass of re.error; a match that runs longer than nltk.redos.DEFAULT_TIMEOUT (5 seconds) raises TimeoutError instead of hanging. Patterns keep re syntax; match objects are the regex engine's (PR #3825, #3829, #3830, #3831, #3832, #3833, #3834, #3835, #3836, #3837, #3838, #3839, #3840, #3841, #3842, #3843, #3844, #3845, #3846, #3796, #3801, #3906, #3907, #3908, #3910)
• Regular expressions made linear: the leading-run and re-anchoring patterns that a timeout cannot catch were rewritten or bounded in the word, Treebank, blankline, TextTiling, toktok and syllable tokenizers, the readline of corpus streams, the CoNLL SRL, TIMIT, senseval, pl196x, NKJP, Alpino, YCOE, IEER, ACE, VerbNet, reviews and Lin readers, relextract, the valuation parser, the CCG lexicon parser, dependency grammars and chomsky_normal_form, each verified on the real corpus (PR #3947, #3934, #3932, #3938, #3935, #3933, #3869, #3944, #3911, #3909, #3953, #3895)
• Size, depth and time bounds: trees deeper than nltk.tree.MAX_TREE_DEPTH (500), WordNet and other relation walks deeper than nltk.util.MAX_RECURSION_DEPTH (500), tgrep deeper than 50, Toolbox deeper than 500, dependency graphs deeper than 200, are refused with ValueError naming the limit rather than exhausting the stack, and the stemmers, distance metrics, skipgrams, parsers and grammar transforms run in linear or bounded time with identical output for legitimate input. chart_parse stops after nltk.parse.chart.DEFAULT_MAX_TIME (5 seconds of wall-clock, needed only for feature grammars; max_time=None disables it). Tree.repr no longer recurses, so a deep accepted tree prints (PR #3827, #3885, #3895, #3767, #3784, #3917, #3958, #3960, #3977)
• External tools and Java: a tool binary is resolved from an absolute path or a trusted search path only, never from the current directory; the binary, its directory and the model and data files handed to it must not be writable by another account (symlinked and multi-call executables such as a packaged Graphviz dot are supported). java() accepts a main class as the first argument only (no -jar, @​argfile or .java source file), validates its options against an allowlist, and loads jars only from a data root unless NLTK_ALLOW_UNSAFE_JARS=1 opts out with a warning. CoreNLP server options are allowlisted. Stanford, Malt, Senna, hunpos, Prover9, megam, TADM, Weka and crf wrappers validate their paths and the text they pipe to the tool against line and argument injection (PR #3772, #3771, #3975, #3743, #3782, #3788, #3768, #3798, #3887, #3858, #3950, #3951, #3812, #3816, #3868, #3894, #3941, #3850, #3925)
• Network: the downloader, nltk.data.load of a URL and the CHILDES reader fetch through pathsec.urlopen, which refuses addresses that are not globally routable (loopback, private, link-local and multicast, including tunnelled and obfuscated forms), pins the validated address for the connection, allows file:// with a local authority only, and refuses a proxied fetch unless NLTK_ALLOW_PROXIED_URLOPEN=1 (or nltk.pathsec.ALLOW_PROXIED_FETCH = True) asserts the proxy is trusted. The CoreNLP client talks to its local server with requests and is not affected (PR #3847, #3810, #3750, #3850)
• Terminal, CSV, DOT and HTML output: every print in the library goes through nltk.termsec.safe_print, which renders control characters, escape sequences and unbalanced bidi overrides from corpus text as visible \xNN escapes instead of letting them reach the terminal. The CSV files the twitter and sentiment helpers write neutralise formula-leading and control-sequence cells, AlignedSent DOT labels are escaped, the WordNet browser escapes corpus text, and nltk.data.load's verbose output no longer prints the full resource URL (PR #3914, #3915, #3937, #3946, #3931, #3930, #3856, #3902)
• Corpus stores and encodings: the PanLex Lite and chat80 sqlite stores open read-only on a pinned descriptor with their schema screened and a statement step budget, chat80 shelves are read by a key manifest, Toolbox SFM markers are sanitised, and a resource encoding that is not a text codec (bz2_codec and friends) is refused (PR #3961, #3964, #3959, #3888, #3800, #3962)
• Package contents: the wheel no longer ships nltk.test.unit (the attack harnesses, advisory probes and their fixtures), so pip install nltk is about half the size and import nltk.test.unit works from a source checkout or the sdist only. The doctests under nltk.test still ship (PR #3954)

Security test and CI infrastructure

• Attack and regression harnesses, advisory probes, the sandbox conftest fixtures, the pre-commit guards (no unsandboxed open, every regex through redos, every pickle through picklesec, every print through safe_print), load-invariant CPU-time timing rules, CI matrix and runner fixes, pinned third-party downl...

  Description has been truncated