chore(ci): ignore unpatched nltk GHSA-8mgp-746c-j5xp

[Vidit-Ostwal]

Related issue

No linked issue. Unblocks Vulnerability Scan after GHSA-8mgp-746c-j5xp (CVE-2026-81726) was published against nltk 3.10.3.

Summary

• Ignore GHSA-8mgp-746c-j5xp in pip-audit (CI + pre-commit) until NLTK ships a patched PyPI release. 3.10.3 is still the latest.
• Document the unpatched model-artifact pathsec bypass on the existing nltk 3.10.3 floor. CrewAI does not call those APIs; nltk is transitive via crewai-tools[xml] → unstructured.

Verification

• Reproduce pip-audit failure on nltk==3.10.3: GHSA-8mgp-746c-j5xp
• Same command with --ignore-vuln GHSA-8mgp-746c-j5xp reports no remaining vulns

Additional context

Same approach as the unpatched chromadb HTTP-server GHSAs. Fixes live on nltk develop only.

  

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 7b74bb69-6414-4f21-b43a-4faf5b79b13c

📥 Commits

Reviewing files that changed from the base of the PR and between 6bcf97a and 31a4ef4.

📒 Files selected for processing (4)

• .github/workflows/vulnerability-scan.yml
• .pre-commit-config.yaml
• lib/crewai-tools/pyproject.toml
• pyproject.toml

🚧 Files skipped from review as they are similar to previous changes (4)

• pyproject.toml
• .github/workflows/vulnerability-scan.yml
• lib/crewai-tools/pyproject.toml
• .pre-commit-config.yaml

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The change documents an unpatched NLTK vulnerability and adds its GHSA identifier to pip-audit exclusions in CI and pre-commit configuration.

Changes

NLTK vulnerability handling

Layer / File(s)	Summary
NLTK security rationale lib/crewai-tools/pyproject.toml, pyproject.toml	The comments document the NLTK version floor, the unpatched GHSA-8mgp-746c-j5xp finding, and the absence of a patched PyPI release.
Audit ignore configuration .github/workflows/vulnerability-scan.yml, .pre-commit-config.yaml	The CI workflow and pre-commit pip-audit hook ignore GHSA-8mgp-746c-j5xp.

Merge Risk: ⚪ Minimal · up to 31a4e

This PR updates vulnerability-scan exclusions for the currently unpatched NLTK dependency. No actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description includes the required sections and explains the change and verification steps. However, the Related issue section states that no issue is linked, which does not satisfy the repository …	Link an existing open issue by replacing "No linked issue" with "Fixes #". Create an issue first if no suitable open issue exists.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the main change: adding an ignore for the unpatched NLTK advisory in CI.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description includes the required sections and explains the change and verification steps. However, the Related issue section states that no issue is linked, which does not satisfy the repository template requirement for an existing open issue.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (4 skipped: 4 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/ignore-nltk-ghsa-8mgp-9f48

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}