[Snyk] Security upgrade nltk from 3.3 to 3.10.3

[brookecastleberry]

Snyk has created this PR to fix 4 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

• pip-sample/requirements.txt

⚠️ Warning

jupyter-console 6.6.3 has requirement ipykernel>=6.14, but you have ipykernel 5.0.0.
jupyter-console 6.6.3 has requirement jupyter-client>=7.0.0, but you have jupyter-client 5.2.3.
jupyter-console 6.6.3 has requirement jupyter-core!=5.0.*,>=4.12, but you have jupyter-core 4.4.0.
jupyter-console 6.6.3 has requirement traitlets>=5.4, but you have traitlets 4.3.2.
Jinja2 2.10 requires MarkupSafe, which is not installed.
ipython 7.34.0 has requirement jedi>=0.16, but you have jedi 0.12.1.

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.
• Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Deserialization of Untrusted Data
🦉 Regular Expression Denial of Service (ReDoS)

[brookecastleberry]

This upgrade of NLTK from version 3.3 to 3.10.3 spans several minor versions and introduces significant changes, most notably in required Python versions and specific function behaviors.

Key Changes:

• Python Version Requirement: The most critical change is the updated Python version requirement. NLTK 3.10.3 requires Python 3.10 or newer. [7] Support for older Python versions was dropped incrementally:

  • Python 2 support was dropped in v3.5. [1]
  • Python 3.5 support was dropped in v3.6.3. [1]
  • Python 3.6 support was dropped in v3.7. [1]
  • Python 3.8 support was dropped in v3.9.2. [1]

• Behavioral Change in WordNet: Starting with version 3.9, NLTK no longer automatically sorts WordNet synsets and relations. [1] Any code that relies on the previously consistent (sorted) order of results from WordNet functions may break or behave differently. You must now explicitly sort the results in your application if a specific order is required.

• METEOR Evaluation: As of version 3.6.5, the METEOR evaluation function requires pre-tokenized input, which may require changes to how it is called. [1]

• Security Hardening: Versions up to 3.10.3 include numerous security fixes for issues like ReDoS, Directory Traversal, and Remote Code Execution (RCE). [2, 6] These changes make the library safer but may introduce stricter input validation.

Recommendation:

Before merging, verify that your production environment runs on Python 3.10 or higher. Review any code that uses NLTK's WordNet or METEOR modules to ensure compatibility with the documented behavioral changes.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.