Changelog:
===========
- docs: wrap Chat-80 HOWTO output
- Sandbox Stanford JAR execution to nltk_data directories
- Harden path-traversal / file-I/O sandbox: close write-side symlink TOCTOU +
shared-temp squat, lock the cluster with a living audit (CWE-22/59/377)
- Extend algorithmic-complexity DoS hardening: repo-wide sweep + two-string
distances (CWE-407/CWE-400)
- Bound unbounded-work DoS in parsers and grammar transforms (CWE-407/674/835)
- fix(security): sandbox MaltParser's Java execution (CVE-2026-12252,
CVE-2026-12841)
- fix(security): trust the system temp dir only when it is private
(CWE-377/CWE-378)
- fix(security): validate corpus-reader roots against the data sandbox (CWE-73)
- fix(security): validate per-call java() options and replace the -XX:/-D
allowlist with a minimal one (CWE-88)
- Additional security hardening (CWE-407, CWE-426, CWE-427, CWE-502, CWE-59,
CWE-776, CWE-918)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changes:
* Support Python 3.14
* Fix bug in Levenshtein distance when substitution_cost > 2
* Fix bug in Treebank detokeniser re quote ordering
* Fix bug in Jaro similarity for empty strings
* Several security enhancements
* Fix GHSA-rf74-v2fm-23pw: unbounded recursion in JSONTaggedDecoder
* Implement TextTiling vocabulary introduction method (Hearst 1997)
* Fix ALINE feature matrix errors and add comprehensive tests
* Support multiple VerbNet versions, fix longid/shortid regex for VerbNet ids
* Let downloader fallback to md5 when sha256 is unavailable
* Several other minor bugfixes and code cleanups
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The CVEs for this project are tracked under nltk:nltk CPE, which doesn't
match the default python:nltk CPE.
See CVE db query:
sqlite> select * from products where PRODUCT like 'nltk';
CVE-2019-14751|nltk|nltk|||3.4.5|<
CVE-2021-3828|nltk|nltk|||3.6.3|<=
CVE-2021-3842|nltk|nltk|||3.6.6|<
CVE-2021-43854|nltk|nltk|||3.6.5|<
Set the CVE_PRODUCT so it can be used to match CVEs.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
=============
* Update download checksums to use SHA256 in built index
* Fix percentage escape in new-style string formatting
* replace shortened URLs using goo.gl
* Make Wordnet interoperable with various taggers and tagged corpora
* Fix saving PerceptronTagger
* Document how to reproduce old Wordnet studies
* properly initialize Portuguese corpus reader
* support for mixed rules conversion into Chomsky Normal Form
* only import tkinter if a GUI is needed
* issue #2112 with Corenlp
* new environment variable NLTK_DOWNLOADER_FORCE_INTERACTIVE_SHELL
* Lesk defaults to most frequent sense in case of ties
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The Natural Language Toolkit (NLTK) is a Python package for
natural language processing.
Signed-off-by: Thomas Perrot <thomas.perrot@bootlin.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Wang Mingyu
Ankur Tyagi
Gyorgy Sarvari
Thomas Perrot