rayhan 1ae1dd1edb fix: remediate nltk CVEs by constraining to >=3.10.0 (#17443) ...

## Summary
  
Remediates five nltk CVEs by adding `nltk>=3.10.0` to
`constraint-dependencies` in `pyproject.toml`.
  
  | CVE | Severity | Installed | Fixed in |
  |---|---|---|---|
  | CVE-2025-14009 | CRITICAL | 3.9.2 | 3.9.3 |
  | CVE-2026-0846 | HIGH | 3.9.2 | 3.9.3 |
  | CVE-2026-0847 | HIGH | 3.9.2 | — |
  | CVE-2026-33231 | HIGH | 3.9.2 | 3.9.4 |
  | CVE-2026-33236 | HIGH | 3.9.2 | — |
  | CVE-2026-54293 | HIGH | 3.9.2 | 3.10.0 |
  | CVE-2026-33230 | MEDIUM | 3.9.2 | 3.9.4 |
  
  CVE-2026-0847 and CVE-2026-33236 have no confirmed fixed version.
 
`nltk` is a transitive dependency (pulled in by `crawl4ai` and
`infinity-sdk`). No package in the graph caps it below 3.10.0. It was
stuck at 3.9.2 simply because the lockfile had never been re-resolved.

2026-07-27 20:38:49 +08:00

834 KiB

Raw Blame History

View Raw