fix: bump nltk to 3.10.3 for PYSEC-2026-3726

[Vidit-Ostwal]

• Raise the nltk floor from 3.10.0 to 3.10.3 in the workspace override and crewai-tools[xml] extra
• Refresh uv.lock so pip-audit no longer reports PYSEC-2026-3726 (symlink file read in IPIPANCorpusReader on 3.10.0–3.10.1)
• Take 3.10.3 rather than 3.10.2 so later 3.10.2 advisories stay cleared as well

Test plan

• Vulnerability Scan / pip-audit no longer reports nltk==3.10.0: PYSEC-2026-3726
• uv.lock resolves nltk 3.10.3

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 21002de7-e073-4968-9c79-e992a52ec30d

📥 Commits

Reviewing files that changed from the base of the PR and between da4daad and 1b22237.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• lib/crewai-tools/pyproject.toml
• pyproject.toml

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request raises NLTK minimum versions from 3.10.0 to 3.10.3 in the XML optional dependency and uv override. It also updates comments with the related security advisories.

Changes

NLTK security constraints

Layer / File(s)	Summary
Raise NLTK minimum versions pyproject.toml, lib/crewai-tools/pyproject.toml	The NLTK constraints now require version 3.10.3. The security comments document the findings addressed by versions 3.10.2 and 3.10.3.

Suggested reviewers: lorenzejay

Merge Risk: ⚪ Minimal · up to 1b222

This PR raises the nltk minimum version and refreshes the lockfile to remove the reported vulnerability; no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the primary change: upgrading NLTK to 3.10.3 to address PYSEC-2026-3726.
Description check	✅ Passed	The description directly explains the NLTK version changes, security objective, lockfile update, and test plan.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/pip-audit-nltk-pysec-2026-3726

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}