v3.0.2
·
35 commits
to main
since this release
v3.0.2
hoyt-harness
Hoyt Harness
This tag was signed with the committer’s verified signature.
hoyt-harness
Hoyt Harness
bfe2da0
This commit was signed with the committer’s verified signature.
hoyt-harness
Hoyt Harness
Changes
- chore(deps): bump nltk from 3.9.4 to 3.10.0 (bfe2da0)
Security
Resolves 5 high-severity vulnerabilities in the nltk transitive dependency (via safety):
- CVE-2026-54293: URL-encoded path traversal in nltk.data.load()
- CVE-2026-12072: Path traversal in NKJPCorpusReader
- CVE-2026-12074: Path traversal in FramenetCorpusReader
- CVE-2026-12061: ReDoS in ReviewsCorpusReader FEATURES regex
- CVE-2026-12075: DNS-rebinding SSRF filter bypass in nltk.pathsec
Also adds defusedxml 0.7.1 as a new transitive dependency (XML entity expansion protection introduced by nltk 3.10.0).
Note: cryptography CVE-2026-69247 (Bleichenbacher oracle) remains open — re-evaluate 2026-08-14.