Bump the uv group across 9 directories with 7 updates

[dependabot]

Bumps the uv group with 4 updates in the / directory: python-socketio, joserfc, nltk and ujson.
Bumps the uv group with 5 updates in the /backend directory:

Package	From	To
python-socketio	5.9.0	5.16.2
azure-identity	1.16.0	1.16.1
nltk	3.9.4	3.10.0
ujson	5.12.1	5.13.0
soupsieve	2.8.3	2.8.4

Bumps the uv group with 3 updates in the /platform-service directory: nltk, ujson and soupsieve.
Bumps the uv group with 3 updates in the /unstract/connectors directory: nltk, ujson and soupsieve.
Bumps the uv group with 3 updates in the /unstract/filesystem directory: nltk, ujson and soupsieve.
Bumps the uv group with 3 updates in the /unstract/sdk1 directory: nltk, ujson and soupsieve.
Bumps the uv group with 3 updates in the /unstract/tool-registry directory: nltk, ujson and soupsieve.
Bumps the uv group with 2 updates in the /unstract/workflow-execution directory: nltk and soupsieve.
Bumps the uv group with 4 updates in the /workers directory: python-socketio, nltk, ujson and soupsieve.

Updates python-socketio from 5.16.1 to 5.16.2

Release notes

Sourced from python-socketio's releases.

Release 5.16.2

See CHANGES.md for release notes.

Changelog

Sourced from python-socketio's changelog.

python-socketio change log

Release 5.16.3 - 2026-06-15

• Catch all exceptions in redis and rabbitmq client managers #1581 (commit)

Release 5.16.2 - 2026-05-21

• Prevent unnecessary resource allocations #1574 (commit)
• Add zizmor to CI builds #1570 (commit)

Release 5.16.1 - 2026-02-06

• Use configured JSON module in managers #1549 (commit)
• Admin UI fixes: remove duplicate tasks, report transport upgrades (commit)
• Switch to Furo documentation template (commit)
• Add Python free-threading to CI #1554 (commit)

Release 5.16.0 - 2025-12-24

• Address deprecation warnings (commit)
• Drop Python 3.8 and 3.9 from CI builds (commit)

Release 5.15.1 - 2025-12-16

• Restore support multiple arguments via pubsub emits #1540 (commit)

Release 5.15.0 - 2025-11-22

• Retry initial Redis connection #1534 ([commit #1](miguelgrinberg/python-socketio@1e903e1) [commit #2](miguelgrinberg/python-socketio@5e898a9))
• Correctly regenerate RabbitMQ binding after a connection failure #1516 (commit) (thanks Gritty_dev!)
• Support ext_type in the MsgPackPacket class #1521 (commit)
• Support sending bytesarrays when using pub/sub managers (commit)
• Fix typos in documentation #1520 (commit) (thanks Lê Nam Khánh!)
• Improvements to the logging documentation (commit)

Release 5.14.3 - 2025-10-29

• Support Python's native ConnectionRefusedError exception to reject a connection #1515 (commit)
• Push binary data to the aiopika client manager #1514 (commit)

Release 5.14.2 - 2025-10-15

• Restore binary message support in message queue setups #1509 (commit)
• Fix formatting of client connection error #1507 (commit)
• Add 3.14 and pypy-3.11 CI tasks (commit)
• Improve documentation of the BaseManager.get_participants() method (commit)

Release 5.14.1 - 2025-10-02

... (truncated)

Commits

• 6e2b717 Release 5.16.2
• cb65829 update python-engineio version
• ca140fe prevent unnecessary resource allocation (#1574)
• b29beef tox configuration
• e898130 Bump ujson from 5.4.0 to 5.12.1 in /examples/server/sanic (#1573) #nolog
• 05c32f5 Bump qs and body-parser in /examples/server/javascript (#1572) #nolog
• 287dc67 Bump qs and body-parser in /examples/client/javascript (#1571) #nolog
• 664dc27 add zizmor to ci (#1570)
• 14c6236 Bump django in /examples/server/wsgi/django_socketio (#1566) #nolog
• 29b2e5c Bump aiohttp from 3.13.3 to 3.13.4 in /examples/server/aiohttp (#1565) #nolog
• Additional commits viewable in compare view

Updates joserfc from 1.6.5 to 1.6.8

Release notes

Sourced from joserfc's releases.

1.6.8

• Reject empty OctKey.

Full Changelog: authlib/joserfc@1.6.7...1.6.8

1.6.7

   🐞 Bug Fixes

• jws: Validate payload size for b64=false  -  by @​lepture (4d4ea)
• typing: Accept any Collection for algorithms, not just list  -  by @​jonathangreen (102a7)
• typing: Use cast for type hints  -  by @​lepture (75d9f)

    View changes on GitHub

Changelog

Sourced from joserfc's changelog.

1.6.8

Released on May 27, 2026

• Reject empty OctKey.

1.6.7

Released on May 23, 2026

• Update for type hints.

1.6.6

Released on May 18, 2026

• JWS: validate payload size when b64=false.

Commits

• ea1d9e3 chore: release 1.6.8
• 86d0091 Reject empty oct key material and empty HMAC keys at sign/verify entry
• 1e5b94d chore: release 1.6.7
• 75d9f95 fix(typing): use cast for type hints
• 6d24037 Merge pull request #98 from jonathangreen/algorithms-accept-collection
• 102a7a7 fix(typing): accept any Collection for algorithms, not just list
• 8b869e8 chore: release 1.6.6
• 00d599b chore: update actions
• 9186561 Merge pull request #97 from authlib/fix-b64
• 4d4ea2e fix(jws): validate payload size for b64=false
• Additional commits viewable in compare view

Updates nltk from 3.9.4 to 3.10.0

Release notes

Sourced from nltk's releases.

v3.10.0

What's Changed

• Let TextCat.guess_language return None for ties by @​ekaf in nltk/nltk#3543
• Fix FunctionalCategory.substitute() ignoring substituted direction by @​elias-ba in nltk/nltk#3547
• Fix concurrent download race conditions with file-based locking by @​ekaf in nltk/nltk#3549
• Fix proxy settings ignored by pathsec.urlopen by @​ekaf in nltk/nltk#3552
• Fix CCG variable direction parsing pipeline by @​ekaf in nltk/nltk#3556
• Fix failing CCG unit tests by @​ekaf in nltk/nltk#3561
• Fix CCG variable capture, chart explosion, and type-raising scope bugs by @​ekaf in nltk/nltk#3557
• fix(security): block XML entity expansion (XXE) in downloader by @​scruge1 in nltk/nltk#3544
• Fix _create_token_table skipping last paragraph break transition + regression test by @​13rac1 in nltk/nltk#3553
• ci(deps): bump actions/github-script from 7 to 8 in the github-actions group by @​dependabot[bot] in nltk/nltk#3546
• Add HuggingFace datasets integration (nltk.huggingface) by @​alvations in nltk/nltk#3569
• fix PorterStemmer not using lowercased word in stem() for irregular forms in NLTK mode by @​Lemm1 in nltk/nltk#3568
• ci(deps): bump the github-actions group with 2 updates by @​dependabot[bot] in nltk/nltk#3572
• Fix WordNetObject comparisons for incompatible types by @​ekaf in nltk/nltk#3570
• Align TnT with Brants (2000) specifications by @​jhnwnstd in nltk/nltk#3564
• Avoid KeyError in langnames.py by @​ekaf in nltk/nltk#3404
• Fix TransitionParser sparse index dtype for scikit-learn 1.9 by @​ekaf in nltk/nltk#3591
• Enable ENFORCE by default and harden downloader concurrency by @​ekaf in nltk/nltk#3593
• Use commonpath for downloader path containment on Windows by @​ekaf in nltk/nltk#3594
• Use lexical containment for downloader target paths by @​ekaf in nltk/nltk#3595
• fix(security): prevent DNS-rebinding SSRF in pathsec.urlopen by @​LinZiyuu in nltk/nltk#3582
• fix(security): block URL-encoded path traversal in nltk: resource URLs by @​LinZiyuu in nltk/nltk#3575
• fix(security): block path traversal in NKJPCorpusReader by @​LinZiyuu in nltk/nltk#3579
• fix(security): block path traversal in FramenetCorpusReader.frame() by @​LinZiyuu in nltk/nltk#3581
• fix(security): prevent ReDoS in ReviewsCorpusReader FEATURES regex (CWE-1333) by @​LinZiyuu in nltk/nltk#3583
• Fix remaining corpus reader pathsec gaps before ENFORCE=True RC by @​ekaf in nltk/nltk#3588
• Cache WordNet max depth lazily for lch_similarity() by @​ekaf in nltk/nltk#3592
• Fix remaining post-merge issues from #3477 and #3498 by @​ekaf in nltk/nltk#3599
• Replace unsafe exec() with importlib in utility CLI by @​ekaf in nltk/nltk#3609
• Document NLTK's new security policy by @​ekaf in nltk/nltk#3597
• Check that CI succeeded on the commit a release tag points to by @​ekaf in nltk/nltk#3506
• Prepare release metadata for 3.10.0 by @​ekaf in nltk/nltk#3610
• Fix release workflow CI check for tagged commits by @​ekaf in nltk/nltk#3611
• Fix perfect-agreement edge cases in agreement metrics by @​Muhtasim-Munif-Fahim in nltk/nltk#3608
• fix(security): prevent ReDoS in TextTilingTokenizer paragraph-break regex (CWE-1333) by @​LinZiyuu in nltk/nltk#3612
• fix(security): prevent ReDoS in SensevalCorpusReader _fixXML (CWE-400) by @​LinZiyuu in nltk/nltk#3614
• fix(security): resolve relative MaltParser dir via MALT_PARSER, not the CWD (CWE-426) by @​LinZiyuu in nltk/nltk#3616
• fix(security): bound LogicParser recursion depth to prevent uncaught RecursionError (CWE-674) by @​LinZiyuu in nltk/nltk#3617
• fix(security): resolve relative ReppTokenizer dir via REPP_TOKENIZER, not the CWD (CWE-427) by @​LinZiyuu in nltk/nltk#3618
• fix(security): do not load weka.jar from the CWD (CWE-494) by @​LinZiyuu in nltk/nltk#3620
• fix(security): do not run the senna binary from the CWD (CWE-829) by @​LinZiyuu in nltk/nltk#3621
• fix(security): prevent ReDoS in chunk tag-pattern parsing (CWE-1333) by @​LiteshGhute in nltk/nltk#3630
• Route _download_package() writes through pathsec.open by @​ekaf in nltk/nltk#3622
• fix(security): resolve symlinks in downloader containment check (CWE-59) by @​LinZiyuu in nltk/nltk#3619
• fix(security): use defusedxml in corpus readers to block XML entity-expansion DoS (CWE-776) by @​LinZiyuu in nltk/nltk#3615
• fix(security): stop exponential ReDoS in XMLCorpusView _VALID_XML_RE (CWE-1333) by @​LinZiyuu in nltk/nltk#3646
• fix(security): route read_sents through pathsec sentinel by @​ekaf in nltk/nltk#3626
• Add RELEASE-Github.md documentation by @​ekaf in nltk/nltk#3627

... (truncated)

Changelog

Sourced from nltk's changelog.

Version 3.10.2 2026-08-05

• Remove inisec.py and document PYTHONSAFEPATH instead
• Skip draft step in release workflow
• Fix symlink escape in FramenetCorpusReader (CWE-59)
• Guard tempfile.gettempdir() when building pathsec allowed roots
• add tests for transitive_closure

Thanks to the following contributors to 3.10.2: Litesh Ghute, Eric Kafe, Evan Kiefer, tarann26 and Rav Singh Chandan

Version 3.10.1 2026-07-29

• Expand ~ in env-var paths
• Validate types after WordNet app pickle deserialization
• Fix uncontrolled search path in HunposTagger
• Use exact thirds in masi_distance
• Avoid retaining bllip import exceptions
• Fix word_tokenize: pad opening single quote before multi-letter words.
• Implement Tree.pformat_latex_forest.
• Prevent module hijacking in inline imports.
• Fix ReDoS in TweetTokenizer URL and email regexes.

Thanks to the following contributors to 3.10.1: Abhinav, Litesh Ghute, Eric Kafe, Eryk Kaźmierczak, Selim C., Muhtasim Munif Fahim, Triniti K., and Tom Y. Mitich.

Version 3.10.0 2026-06-11

• Enforce the stricter nltk.pathsec security policy by default
• Document the new security model and migration guidance
• Harden resource loading against path traversal and SSRF/DNS-rebinding
• Harden downloader path handling and block XML entity expansion
• Close remaining corpus-reader security edge cases
• Replace unsafe exec() usage in the utility CLI
• Warn on unpickling user-provided pickles
• Add HuggingFace datasets integration (nltk.huggingface)
• Align TnT with Brants (2000) specifications
• Fix PorterStemmer irregular-form lowercasing in NLTK mode
• Fix TransitionParser sparse index dtype for scikit-learn 1.9
• Fix TextCat tie handling
• Fix WordNet object comparisons for incompatible types
• Cache WordNet max depth lazily for lch_similarity()
• Fix CCG variable direction, substitution, and type-raising bugs
• Fix Jaro similarity for single-character and empty-string cases
• Improve CI and release-maintenance workflows

Thanks to the following contributors to 3.10.0: 13rac1, alvations, bowiechen, devesh-2002, ekaf, elias-ba, haosenwang1018, HyperPS, ihitamandal, jancallewaert, jhnwnstd,

... (truncated)

Commits

• bd49f90 allow escaped brackets in Tree.fromstring (#3694)
• 27b8ad6 don't crash chomsky_normal_form on terminals with siblings (#3693)
• 52227d2 Use os.name for Windows path handling (#3605)
• 06c0e2c Avoid RIBES zero division on empty inputs (#3604)
• a167389 Treat missing unzip output as stale (#3607)
• c94c967 Fix EOF empty document bug in IEER corpus reader (#3648)
• 94a259c Enforce restrictive primitive type checking in pathsec wrappers (#3692)
• 5ac475d fix(security): isolate Stanford Java options and clean temp files (#3683)
• 986f26e ci(deps): bump the github-actions group with 3 updates (#3691)
• f26b375 fix(security): prevent pickle RCE in TransitionParser model loading (CWE-502)...
• Additional commits viewable in compare view

Updates python-engineio from 4.13.1 to 4.13.4

Release notes

Sourced from python-engineio's releases.

Release 4.13.4

See CHANGES.md for release notes.

Release 4.13.3

See CHANGES.md for release notes.

Release 4.13.2

See CHANGES.md for release notes.

Changelog

Sourced from python-engineio's changelog.

python-engineio change log

Release 4.13.4 - 2026-07-31

• Prevent a race condition in the sync client's connection close handling #458 (commit)
• Cleaner WebSocket exit for Werkzeug #457 (commit)

Release 4.13.3 - 2026-06-20

• Make sure client disconnects when write loop exits #455 (commit)
• Address flaky unit test #444 (commit)
• Stop using codecov service, since it has been failing for a long time (commit)

Release 4.13.2 - 2026-05-21

• Prevent unnecessary resource allocations #441 (commit)
• Add zizmor to CI builds #437 (commit)

Release 4.13.1 - 2026-02-06

• Document that a process can have only one custom JSON module (commit)
• Switch to Furo documentation template (commit)

Release 4.13.0 - 2025-12-24

• Apply escaping rules when parsing cookie values (commit)
• Several minor improvements to the aiohttp integration #419 (commit) (thanks PaulWasTaken!)
• Clarify logging behavior in documentation #421 (commit) (thanks ZipFile!)
• Address deprecation warnings #422 (commit)
• Add 3.14 and pypy-3.11 CI builds (commit)
• Drop Python 3.8 and 3.9 from CI builds (commit)

Release 4.12.3 - 2025-09-28

• Reset client queue upon disconnection #414 (commit)
• Support ['*'] in addition to '*' in the cors_allowed_origins option #410 (commit) (thanks Wu Clan!)

Release 4.12.2 - 2025-06-04

• Support new monkey-patched gevent Queue class in the client #403 (commit)
• Better support of the ASGI spec when interpreting WebSocket events #405 (commit) (thanks Eric Zhang!)

Release 4.12.1 - 2025-05-11

• Accept empty binary values in the async server #404 (commit)
• Add SPDX license identifier #401 (commit) (thanks Marc Mueller!)

Release 4.12.0 - 2025-04-12

• Optimize packet parsing to avoid unnecessary calls to JSON parser #399 (commit)

... (truncated)

Commits

• 0583161 Release 4.13.4
• 505b5d2 Prevent a race condition at connection close (Fixes #458)
• c729c9a Cleaner WebSocket exit for Werkzeug (Fixes #457)
• ddf9d4c Bump body-parser from 1.20.5 to 1.20.6 in /examples/server/javascript (#459) ...
• 59a5990 Version 4.13.4.dev0
• a53d58c Release 4.13.3
• 9e72608 Remove failing coverage.py service
• 7517473 Make sure client disconnects when write loop exists (Fixes #454) (#455)
• 6902ffc Bump ws, engine.io and engine.io-client in /examples/client/javascript (#453)...
• 883c8f4 Bump tornado from 6.5.5 to 6.5.7 in /examples/server/tornado (#451)
• Additional commits viewable in compare view

Updates ujson from 5.12.1 to 5.13.0

Release notes

Sourced from ujson's releases.

5.13.0

Added

• Create manylinux2014 wheels (#745) @​hugovk
• Add support for Python 3.15 (#742) @​hugovk
• Disable global interpreter lock for freethreading (#737) @​bwoodsend
• Re-enable building GraalPy wheels on macOS arm64 (#733) @​timfel

Changed

• Move metadata from setup.cfg to pyproject.toml (#736) @​hugovk

Fixed

• Tighten UTF-8 validation for ujson.dumps(b"...", reject_bytes=False) (169eaf36b1116fece5034ee79a7a0ef3f6deedcf) @​bwoodsend
• Replace generated version.h with macro (#735) @​hugovk

Commits

• 1a23a68 Create manylinux2014 wheels (#745)
• bd943e8 Build separate manylinux2014 + modern wheels
• 87ae2df Create manylinux2014 wheels
• 209371e Verify expected number of dists (#743)
• 6392258 Also check SHA of wheels in case manylinux version changes
• a00edea Verify expected number of dists
• e24aeb7 Fix utf-8 test for graalpy
• 9122ebe Replace pre-commit with prek to fix deprecation warning (#744)
• 0bbf9a3 Add support for Python 3.15 (#742)
• 90ddea2 Replace pre-commit with prek to fix deprecation warning
• Additional commits viewable in compare view

Updates python-socketio from 5.16.1 to 5.16.2

Release notes

Sourced from python-socketio's releases.

Release 5.16.2

See CHANGES.md for release notes.

Changelog

Sourced from python-socketio's changelog.

python-socketio change log

Release 5.16.3 - 2026-06-15

• Catch all exceptions in redis and rabbitmq client managers #1581 (commit)

Release 5.16.2 - 2026-05-21

• Prevent unnecessary resource allocations #1574 (commit)
• Add zizmor to CI builds #1570 (commit)

Release 5.16.1 - 2026-02-06

• Use configured JSON module in managers #1549 (commit)
• Admin UI fixes: remove duplicate tasks, report transport upgrades (commit)
• Switch to Furo documentation template (commit)
• Add Python free-threading to CI #1554 (commit)

Release 5.16.0 - 2025-12-24

• Address deprecation warnings (commit)
• Drop Python 3.8 and 3.9 from CI builds (commit)

Release 5.15.1 - 2025-12-16

• Restore support multiple arguments via pubsub emits #1540 (commit)

Release 5.15.0 - 2025-11-22

• Retry initial Redis connection #1534 ([commit #1](miguelgrinberg/python-socketio@1e903e1) [commit #2](miguelgrinberg/python-socketio@5e898a9))
• Correctly regenerate RabbitMQ binding after a connection failure #1516 (commit) (thanks Gritty_dev!)
• Support ext_type in the MsgPackPacket class #1521 (commit)
• Support sending bytesarrays when using pub/sub managers (commit)
• Fix typos in documentation #1520 (commit) (thanks Lê Nam Khánh!)
• Improvements to the logging documentation (commit)

Release 5.14.3 - 2025-10-29

• Support Python's native ConnectionRefusedError exception to reject a connection #1515 (commit)
• Push binary data to the aiopika client manager #1514 (commit)

Release 5.14.2 - 2025-10-15

• Restore binary message support in message queue setups #1509 (commit)
• Fix formatting of client connection error #1507 (commit)
• Add 3.14 and pypy-3.11 CI tasks (commit)
• Improve documentation of the BaseManager.get_participants() method (commit)

Release 5.14.1 - 2025-10-02

... (truncated)

Commits

• 6e2b717 Release 5.16.2
• cb65829 update python-engineio version
• ca140fe prevent unnecessary resource allocation (#1574)
• b29beef tox configuration
• e898130 Bump ujson from 5.4.0 to 5.12.1 in /examples/server/sanic (#1573) #nolog
• 05c32f5 Bump qs and body-parser in /examples/server/javascript (#1572) #nolog
• 287dc67 Bump qs and body-parser in /examples/client/javascript (#1571) #nolog
• 664dc27 add zizmor to ci (#1570)
• 14c6236 Bump django in /examples/server/wsgi/django_socketio (#1566) #nolog
• 29b2e5c Bump aiohttp from 3.13.3 to 3.13.4 in /examples/server/aiohttp (#1565) #nolog
• Additional commits viewable in compare view

Updates nltk from 3.9.4 to 3.10.0

Release notes

Sourced from nltk's releases.

v3.10.0

What's Changed

• Let TextCat.guess_language return None for ties by @​ekaf in nltk/nltk#3543
• Fix FunctionalCategory.substitute() ignoring substituted direction by @​elias-ba in nltk/nltk#3547
• Fix concurrent download race conditions with file-based locking by @​ekaf in nltk/nltk#3549
• Fix proxy settings ignored by pathsec.urlopen by @​ekaf in nltk/nltk#3552
• Fix CCG variable direction parsing pipeline by @​ekaf in nltk/nltk#3556
• Fix failing CCG unit tests by @​ekaf in nltk/nltk#3561
• Fix CCG variable capture, chart explosion, and type-raising scope bugs by @​ekaf in nltk/nltk#3557
• fix(security): block XML entity expansion (XXE) in downloader by @​scruge1 in nltk/nltk#3544
• Fix _create_token_table skipping last paragraph break transition + regression test by @​13rac1 in nltk/nltk#3553
• ci(deps): bump actions/github-script from 7 to 8 in the github-actions group by @​dependabot[bot] in nltk/nltk#3546
• Add HuggingFace datasets integration (nltk.huggingface) by @​alvations in nltk/nltk#3569
• fix PorterStemmer not using lowercased word in stem() for irregular forms in NLTK mode by @​Lemm1 in nltk/nltk#3568
• ci(deps): bump the github-actions group with 2 updates by @​dependabot[bot] in nltk/nltk#3572
• Fix WordNetObject comparisons for incompatible types by @​ekaf in nltk/nltk#3570
• Align TnT with Brants (2000) specifications by @​jhnwnstd in nltk/nltk#3564
• Avoid KeyError in langnames.py by @​ekaf in nltk/nltk#3404
• Fix TransitionParser sparse index dtype for scikit-learn 1.9 by @​ekaf in nltk/nltk#3591
• Enable ENFORCE by default and harden downloader concurrency by @​ekaf in nltk/nltk#3593
• Use commonpath for downloader path containment on Windows by @​ekaf in nltk/nltk#3594
• Use lexical containment for downloader target paths by @​ekaf in nltk/nltk#3595
• fix(security): prevent DNS-rebinding SSRF in pathsec.urlopen by @​LinZiyuu in nltk/nltk#3582
• fix(security): block URL-encoded path traversal in nltk: resource URLs by @​LinZiyuu in nltk/nltk#3575
• fix(security): block path traversal in NKJPCorpusReader by @​LinZiyuu in nltk/nltk#3579
• fix(security): block path traversal in FramenetCorpusReader.frame() by @​LinZiyuu in nltk/nltk#3581
• fix(security): prevent ReDoS in ReviewsCorpusReader FEATURES regex (CWE-1333) by @​LinZiyuu in nltk/nltk#3583
• Fix remaining corpus reader pathsec gaps before ENFORCE=True RC by @​ekaf in nltk/nltk#3588
• Cache WordNet max depth lazily for lch_similarity() by @​ekaf in nltk/nltk#3592
• Fix remaining post-merge issues from #3477 and #3498 by @​ekaf in nltk/nltk#3599
• Replace unsafe exec() with importlib in utility CLI by @​ekaf in nltk/nltk#3609
• Document NLTK's new security policy by @​ekaf in nltk/nltk#3597
• Check that CI succeeded on the commit a release tag points to by @​ekaf in nltk/nltk#3506
• Prepare release metadata for 3.10.0 by @​ekaf in nltk/nltk#3610
• Fix release workflow CI check for tagged commits by @​ekaf in nltk/nltk#3611
• Fix perfect-agreement edge cases in agreement metrics by @​Muhtasim-Munif-Fahim in nltk/nltk#3608
• fix(security): prevent ReDoS in TextTilingTokenizer paragraph-break regex (CWE-1333) by @​LinZiyuu in nltk/nltk#3612
• fix(security): prevent ReDoS in SensevalCorpusReader _fixXML (CWE-400) by @​LinZiyuu in nltk/nltk#3614
• fix(security): resolve relative MaltParser dir via MALT_PARSER, not the CWD (CWE-426) by @​LinZiyuu in nltk/nltk#3616
• fix(security): bound LogicParser recursion depth to prevent uncaught RecursionError (CWE-674) by @​LinZiyuu in nltk/nltk#3617
• fix(security): resolve relative ReppTokenizer dir via REPP_TOKENIZER, not the CWD (CWE-427) by @​LinZiyuu in nltk/nltk#3618
• fix(security): do not load weka.jar from the CWD (CWE-494) by @​LinZiyuu in nltk/nltk#3620
• fix(security): do not run the senna binary from the CWD (CWE-829) by @​LinZiyuu in nltk/nltk#3621
• fix(security): prevent ReDoS in chunk tag-pattern parsing (CWE-1333) by @​LiteshGhute in nltk/nltk#3630
• Route _download_package() writes through pathsec.open by @​ekaf in nltk/nltk#3622
• fix(security): resolve...

  Description has been truncated

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[greptile-apps]

Greptile Summary

This PR updates seven Python dependencies across the repository’s independently locked services and libraries.

• Upgrades NLTK, ujson, SoupSieve, python-socketio, python-engineio, joserfc, and azure-identity where applicable.
• Adds NLTK’s new defusedxml transitive dependency.
• Regenerates the workers lockfile using the newer uv lock format without introducing additional package-resolution changes.

Confidence Score: 5/5

The PR appears safe to merge; no concrete changed-code failure or actionable compatibility issue was identified.

The manifests and lockfiles consistently resolve the requested dependency updates, and the regenerated workers lockfile contains no unintended package-resolution changes beyond the declared update group.

Important Files Changed

Filename	Overview
backend/pyproject.toml	Raises the backend’s pinned python-socketio and azure-identity versions consistently with its lockfile.
backend/uv.lock	Resolves the requested backend dependency updates and adds defusedxml through NLTK 3.10.
workers/pyproject.toml	Raises the minimum python-socketio version used by worker log emission.
workers/uv.lock	Updates the intended five package resolutions; the large remaining diff is uv lock-format metadata regeneration.
uv.lock	Updates the root resolutions for joserfc, NLTK, Socket.IO/Engine.IO, and ujson.
unstract/workflow-execution/uv.lock	Updates transitive NLTK and SoupSieve resolutions consistently.
platform-service/uv.lock	Updates NLTK, SoupSieve, and ujson resolutions consistently.

_{Reviews (1): Last reviewed commit: "Bump the uv group across 9 directories w..." | Re-trigger Greptile}

[jaseemjaskp]

Automated dependency-bump review (Dependabot uv-group PR). One blocking finding: the python-socketio bump doesn't reach the version that fixes a DoS advisory published yesterday. Everything else here is informational/positive confirmation of other CVE fixes this PR already lands.

[jaseemjaskp]

[blocking] This bumps python-socketio to 5.16.2, but GHSA-g8c6-8fjj-2r4m / CVE-2026-48804 (memory-exhaustion DoS via unbounded binary-attachment buffering in multi-server Socket.IO deployments) was published 2026-08-11 and is fixed only in 5.16.4. 5.16.2 is still in the vulnerable range. Suggest pinning python-socketio>=5.16.4 and re-running uv lock here and in backend/uv.lock.

[jaseemjaskp]

[blocking] Same issue as backend/pyproject.toml: python-socketio>=5.16.2 is still vulnerable to GHSA-g8c6-8fjj-2r4m / CVE-2026-48804 (fixed in 5.16.4). Suggest bumping this pin to >=5.16.4 too and re-running uv lock.

[jaseemjaskp]

[nit] Good catch by this bump — joserfc 1.6.5 -> 1.6.8 fixes GHSA-gg9x-qcx2-xmrh / CVE-2026-49852, where HS256/384/512 JWT verification accepted empty/nil HMAC keys (forgeable tokens if a secret ever resolved to ""/unset). No action needed, just flagging why this one matters.

[jaseemjaskp]

[nit] This ujson 5.12.1 -> 5.13.0 bump fixes CVE-2026-54911. No action needed.

[jaseemjaskp]

[nit] nltk 3.9.4 -> 3.10.0 pulls in defusedxml as a new transitive dependency (hardens XML parsing). No regression: the earlier Zip-Slip RCE (CVE-2025-14009) was already patched at 3.9.3, so there's no exposure window either side of this bump.

[jaseemjaskp]

[nit] soupsieve -> 2.8.4 is a bug-fix release (attribute/:nth-child selector matching) that also drops upstream Python 3.9 support. Not a concern here since this repo pins requires-python = ">=3.12,<3.13" throughout.

[jaseemjaskp]

[nit] azure-identity 1.16.0 -> 1.16.1 is a routine managed-identity bug-fix release, no known CVE. No action needed.

[jaseemjaskp]

[nit] python-engineio 4.13.1 -> 4.13.4 is pulled in transitively by the python-socketio bump; routine release, no known CVE. No action needed.