chore(deps): bump nltk from 3.10.0 to 3.10.3 in /template in the pip group across 1 directory - #335
chore(deps): bump nltk from 3.10.0 to 3.10.3 in /template in the pip group across 1 directory#335dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the pip group with 1 update in the /template directory: [nltk](https://github.com/nltk/nltk). Updates `nltk` from 3.10.0 to 3.10.3 - [Release notes](https://github.com/nltk/nltk/releases) - [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog) - [Commits](nltk/nltk@v3.10.0...v3.10.3) --- updated-dependencies: - dependency-name: nltk dependency-version: 3.10.3 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
python
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Looks good, straightforward version bump. This PR only changes the pinned nltk version in template/requirements.txt from 3.10.0 to 3.10.3, with no other files touched — checked the diff and confirmed it is a single-line change matching the stated dependency bump.
Extended reasoning...
Overview
The diff touches a single file, template/requirements.txt, changing one line to bump the pinned nltk dependency from 3.10.0 to 3.10.3. No source code, configuration, or other dependency files are modified.
Security risks
None introduced by this change itself. The bump is to a newer patch version of nltk that per the PR description includes several security hardening fixes (path traversal, DoS bounding, sandboxing of subprocess execution). Since this only raises the pinned version and does not add/remove any code paths in this repo, there is no new attack surface here.
Level of scrutiny
This warrants minimal scrutiny: it is a single-line, mechanical version bump in a pinned requirements file, authored by dependabot, with no code changes elsewhere in the repository to review.
Other factors
No CODEOWNERS restriction apparent for this file, no prior review threads or objections in the timeline, and no bug hunter findings were reported. The change is self-contained and easily reversible if it caused any issue.
Bumps the pip group with 1 update in the /template directory: nltk.
Updates
nltkfrom 3.10.0 to 3.10.3Release notes
Sourced from nltk's releases.
... (truncated)
Changelog
Sourced from nltk's changelog.
... (truncated)
Commits
303f6e2Prepare release 3.10.3 (#3745)cf2aaacMerge pull request #3744 from alvations/ci-guard-open6cd8320test: robustness on Python 3.14 / 3.14t CI (UnicodeDecodeError + timing flake)e965330fix: perceptron save_to_json breaks on Windows (os.open can't fd-open a direc...df1bb4ctest: make pathsec security tests platform-independent (fix Linux/Windows CI)0e5c7beci: guard against un-sandboxed open() in sandbox-sensitive modules (#3740)5017826Merge commit from fork40d0f06Triple-check hardening: perceptron TOCTOU squat, pathsec fd-leak, bcp47 entit...483c5feHarden path-traversal / file-I/O sandbox: close write-side symlink TOCTOU + s...722778fMerge commit from forkDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.