build(deps): bump the minor-and-patch group across 1 directory with 3 updates by dependabot[bot] · Pull Request #552 · Aggregate-Intellect/sherpa

dependabot · 2026-08-04T14:19:41Z

Bumps the minor-and-patch group with 3 updates in the /src directory: langchain-core, nltk and boto3.

Updates langchain-core from 1.5.2 to 1.5.3

Release notes

Sourced from langchain-core's releases.

langchain-core==1.5.3

Changes since langchain-core==1.5.2

release(core): 1.5.3 (#39145) fix(core): fall back to LANGSMITH_API_KEY for gateway (#39115)

Commits

01d8481 release(core): 1.5.3 (#39145)
b8a6e36 chore(model-profiles): refresh model profile data (#39141)
cdca311 fix(core): fall back to LANGSMITH_API_KEY for gateway (#39115)
a5a8762 ci: annotate uv bump workflow with PR links (#39112)
557c0a9 chore(deps): bump uv to 0.12.0 (#39111)
835c85a release(anthropic): 1.5.3 (#39109)
See full diff in compare view

Updates nltk from 3.10.0 to 3.10.1

Release notes

Sourced from nltk's releases.

v3.10.1-rc2

What's Changed

use exact thirds in masi_distance (fixes #3361) by @CodingSelim in nltk/nltk#3695

Fix uncontrolled search path in HunposTagger by @ekaf in nltk/nltk#3715

Fix word_tokenize: pad opening single quote before multi-letter words by @trinik15 in nltk/nltk#3687

Avoid retaining bllip import exceptions by @Muhtasim-Munif-Fahim in nltk/nltk#3601

Implement Tree.pformat_latex_forest by @tyomitch in nltk/nltk#2956

fix(security): validate types after wordnet_app pickle deserialization by @LiteshGhute in nltk/nltk#3714

Expand ~ in env-var paths (NLTK_DATA, find_file_iter) by @Abhi-DevHub in nltk/nltk#3708

Update ChangeLog for v. 3.10.1 by @ekaf in nltk/nltk#3717

New Contributors

@trinik15 made their first contribution in nltk/nltk#3687

@tyomitch made their first contribution in nltk/nltk#2956

@Abhi-DevHub made their first contribution in nltk/nltk#3708

Full Changelog: nltk/nltk@v3.10.1-rc1...v3.10.1-rc2

v3.10.1-rc1

What's Changed

Fix perfect-agreement edge cases in agreement metrics by @Muhtasim-Munif-Fahim in nltk/nltk#3608

fix(security): prevent ReDoS in TextTilingTokenizer paragraph-break regex (CWE-1333) by @LinZiyuu in nltk/nltk#3612

fix(security): prevent ReDoS in SensevalCorpusReader _fixXML (CWE-400) by @LinZiyuu in nltk/nltk#3614

fix(security): resolve relative MaltParser dir via MALT_PARSER, not the CWD (CWE-426) by @LinZiyuu in nltk/nltk#3616

fix(security): bound LogicParser recursion depth to prevent uncaught RecursionError (CWE-674) by @LinZiyuu in nltk/nltk#3617

fix(security): resolve relative ReppTokenizer dir via REPP_TOKENIZER, not the CWD (CWE-427) by @LinZiyuu in nltk/nltk#3618

fix(security): do not load weka.jar from the CWD (CWE-494) by @LinZiyuu in nltk/nltk#3620

fix(security): do not run the senna binary from the CWD (CWE-829) by @LinZiyuu in nltk/nltk#3621

fix(security): prevent ReDoS in chunk tag-pattern parsing (CWE-1333) by @LiteshGhute in nltk/nltk#3630

Route _download_package() writes through pathsec.open by @ekaf in nltk/nltk#3622

fix(security): resolve symlinks in downloader containment check (CWE-59) by @LinZiyuu in nltk/nltk#3619

fix(security): use defusedxml in corpus readers to block XML entity-expansion DoS (CWE-776) by @LinZiyuu in nltk/nltk#3615

fix(security): stop exponential ReDoS in XMLCorpusView _VALID_XML_RE (CWE-1333) by @LinZiyuu in nltk/nltk#3646

fix(security): route read_sents through pathsec sentinel by @ekaf in nltk/nltk#3626

Add RELEASE-Github.md documentation by @ekaf in nltk/nltk#3627

fix(security): do not run the candc/boxer binary from the CWD (CWE-426) by @LinZiyuu in nltk/nltk#3623

fix(security): algorithmic-complexity DoS in DependencyGraph.contains_cycle by @LinZiyuu in nltk/nltk#3632

fix(security): bound recursion in PorterStemmer._is_consonant (CWE-674) by @LinZiyuu in nltk/nltk#3633

fix(security): close validate/extract path mismatch in pathsec Zip-Slip guard (CWE-22) by @LinZiyuu in nltk/nltk#3634

fix(security): validate path in GzipFileSystemPathPointer.open() (CWE-22) by @LinZiyuu in nltk/nltk#3635

fix(security): require a session token for WordNet Browser shutdown (CWE-352) by @LinZiyuu in nltk/nltk#3637

fix(security): remove quadratic scan in VADER polarity_scores (CWE-407) by @LinZiyuu in nltk/nltk#3638

fix(security): bound super-linear n-gram scan in RIBES word_rank_alignment (CWE-407) by @LinZiyuu in nltk/nltk#3639

fix(security): route custom_distance through the pathsec sentinel (CWE-22) by @LinZiyuu in nltk/nltk#3640

fix(security): stop quadratic ReDoS in CCG lexicon parsing (CWE-1333) by @LinZiyuu in nltk/nltk#3641

fix(security): reject CWD-relative binaries in find_binary (CWE-426) by @LinZiyuu in nltk/nltk#3642

fix(ci): resolve isort block (#3615) and restore CCG lexicon syntax (#3641) by @LinZiyuu in nltk/nltk#3677

fix(security): read XML corpora through the path-pointer sentinel (CWE-22) by @LinZiyuu in nltk/nltk#3636

fix(security): cap zip decompression to prevent decompression-bomb DoS (CWE-409) by @LinZiyuu in nltk/nltk#3613

fix(security): stop symlink-following arbitrary deletion in Downloader stale-cleanup (CWE-59) by @LinZiyuu in nltk/nltk#3643

... (truncated)

Changelog

Sourced from nltk's changelog.

Version 3.10.2 2026-08-05

Remove inisec.py and document PYTHONSAFEPATH instead

Skip draft step in release workflow

Fix symlink escape in FramenetCorpusReader (CWE-59)

Guard tempfile.gettempdir() when building pathsec allowed roots

add tests for transitive_closure

Thanks to the following contributors to 3.10.2: Litesh Ghute, Eric Kafe, Evan Kiefer, tarann26 and Rav Singh Chandan

Version 3.10.1 2026-07-29

Expand ~ in env-var paths

Validate types after WordNet app pickle deserialization

Fix uncontrolled search path in HunposTagger

Use exact thirds in masi_distance

Avoid retaining bllip import exceptions

Fix word_tokenize: pad opening single quote before multi-letter words.

Implement Tree.pformat_latex_forest.

Prevent module hijacking in inline imports.

Fix ReDoS in TweetTokenizer URL and email regexes.

Thanks to the following contributors to 3.10.1: Abhinav, Litesh Ghute, Eric Kafe, Eryk Kaźmierczak, Selim C., Muhtasim Munif Fahim, Triniti K., and Tom Y. Mitich.

Version 3.10.0 2026-06-11

Enforce the stricter nltk.pathsec security policy by default

Document the new security model and migration guidance

Harden resource loading against path traversal and SSRF/DNS-rebinding

Harden downloader path handling and block XML entity expansion

Close remaining corpus-reader security edge cases

Replace unsafe exec() usage in the utility CLI

Warn on unpickling user-provided pickles

Add HuggingFace datasets integration (nltk.huggingface)

Align TnT with Brants (2000) specifications

Fix PorterStemmer irregular-form lowercasing in NLTK mode

Fix TransitionParser sparse index dtype for scikit-learn 1.9

Fix TextCat tie handling

Fix WordNet object comparisons for incompatible types

Cache WordNet max depth lazily for lch_similarity()

Fix CCG variable direction, substitution, and type-raising bugs

Fix Jaro similarity for single-character and empty-string cases

Improve CI and release-maintenance workflows

Thanks to the following contributors to 3.10.0: 13rac1, alvations, bowiechen, devesh-2002, ekaf, elias-ba, haosenwang1018, HyperPS, ihitamandal, jancallewaert, jhnwnstd,

... (truncated)

Commits

35813c8 Merge pull request #3724 from tarann26/fix-tweet-tokenizer-non-latin-hang
7a757d6 Merge pull request #3702 from maxtaran2010/fix/typos-classify-tokenize-parse
591aec0 Merge pull request #3723 from tarann26/fix-detokenize-mid-string-period
ff85b23 Merge pull request #3707 from chuenchen309/fix/spanish-stemmer-ucion-suffix
b2b8961 Merge pull request #3719 from Abhi-DevHub/fix-megam-url
3ce739c Merge pull request #3722 from ekaf/hotfix-3721
e9aec10 don't collapse repeated non-Latin letters in TweetTokenizer
dbe3073 Skip Python 3.10 test
ac2a518 Handle and test worker processes
d91e79e detokenize periods mid-string, not just the last one
Additional commits viewable in compare view

Updates boto3 from 1.43.58 to 1.43.62

Commits

f3e9c52 Merge branch 'release-1.43.62'
47765b7 Bumping version to 1.43.62
2f4f5fb Add changelog entries from botocore
8cd8552 Merge branch 'release-1.43.61'
53d9670 Merge branch 'release-1.43.61' into develop
74101e1 Bumping version to 1.43.61
7faedb5 Add changelog entries from botocore
785f6ff Merge branch 'release-1.43.60'
550ff07 Merge branch 'release-1.43.60' into develop
68f5316 Bumping version to 1.43.60
Additional commits viewable in compare view

… updates Bumps the minor-and-patch group with 3 updates in the /src directory: [langchain-core](https://github.com/langchain-ai/langchain), [nltk](https://github.com/nltk/nltk) and [boto3](https://github.com/boto/boto3). Updates `langchain-core` from 1.5.2 to 1.5.3 - [Release notes](https://github.com/langchain-ai/langchain/releases) - [Commits](langchain-ai/langchain@langchain-core==1.5.2...langchain-core==1.5.3) Updates `nltk` from 3.10.0 to 3.10.1 - [Release notes](https://github.com/nltk/nltk/releases) - [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog) - [Commits](nltk/nltk@v3.10.0...v3.10.1) Updates `boto3` from 1.43.58 to 1.43.62 - [Release notes](https://github.com/boto/boto3/releases) - [Commits](boto/boto3@1.43.58...1.43.62) --- updated-dependencies: - dependency-name: boto3 dependency-version: 1.43.62 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: langchain-core dependency-version: 1.5.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: nltk dependency-version: 3.10.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 4, 2026

dependabot Bot changed the title ~~build(deps): bump the minor-and-patch group in /src with 3 updates~~ build(deps): bump the minor-and-patch group across 1 directory with 3 updates Aug 5, 2026

dependabot Bot force-pushed the dependabot/pip/src/minor-and-patch-13067b04bc branch from c20a931 to af9cc88 Compare August 5, 2026 23:26

Navigation Menu

Uh oh!

build(deps): bump the minor-and-patch group across 1 directory with 3 updates - #552

build(deps): bump the minor-and-patch group across 1 directory with 3 updates#552
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/src/minor-and-patch-13067b04bc

dependabot Bot commented on behalf of github Aug 4, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

langchain-core==1.5.3

v3.10.1-rc2

What's Changed

New Contributors

v3.10.1-rc1

What's Changed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Aug 4, 2026 •

edited

Loading