chore(deps): bump the uv group across 27 directories with 2 updates by dependabot[bot] · Pull Request #2402 · google/adk-samples

dependabot · 2026-08-01T03:06:16Z

Bumps the uv group with 2 updates in the /python/agents/academic-research directory: nltk and pyjwt.
Bumps the uv group with 2 updates in the /python/agents/adk-ae-oauth directory: nltk and pyjwt.
Bumps the uv group with 2 updates in the /python/agents/brand-aligned-presentations directory: nltk and pyjwt.
Bumps the uv group with 2 updates in the /python/agents/brand-search-optimization directory: nltk and pyjwt.
Bumps the uv group with 1 update in the /python/agents/customer-service directory: pyjwt.
Bumps the uv group with 2 updates in the /python/agents/cyber-guardian-agent directory: nltk and pyjwt.
Bumps the uv group with 2 updates in the /python/agents/data-science directory: nltk and pyjwt.
Bumps the uv group with 1 update in the /python/agents/deep-search directory: pyjwt.
Bumps the uv group with 2 updates in the /python/agents/economic-research-agent directory: nltk and pyjwt.
Bumps the uv group with 2 updates in the /python/agents/fomc-research directory: nltk and pyjwt.
Bumps the uv group with 1 update in the /python/agents/genmedia-for-commerce directory: pyjwt.
Bumps the uv group with 2 updates in the /python/agents/global-kyc-agent directory: nltk and pyjwt.
Bumps the uv group with 2 updates in the /python/agents/high-volume-document-analyzer directory: nltk and pyjwt.
Bumps the uv group with 1 update in the /python/agents/image-scoring directory: pyjwt.
Bumps the uv group with 2 updates in the /python/agents/llm-auditor directory: nltk and pyjwt.
Bumps the uv group with 1 update in the /python/agents/marketing-agency directory: nltk.
Bumps the uv group with 2 updates in the /python/agents/memory-bank directory: nltk and pyjwt.
Bumps the uv group with 2 updates in the /python/agents/multiformat-hybrid-rag directory: nltk and pyjwt.
Bumps the uv group with 1 update in the /python/agents/nurse-handover directory: pyjwt.
Bumps the uv group with 2 updates in the /python/agents/on-brand-genmedia directory: nltk and pyjwt.
Bumps the uv group with 2 updates in the /python/agents/personalized-shopping directory: nltk and pyjwt.
Bumps the uv group with 1 update in the /python/agents/safety-plugins directory: pyjwt.
Bumps the uv group with 2 updates in the /python/agents/sdlc-task-planner directory: nltk and pyjwt.
Bumps the uv group with 2 updates in the /python/agents/sdlc-technical-designer directory: nltk and pyjwt.
Bumps the uv group with 2 updates in the /python/agents/sdlc-user-story-refiner directory: nltk and pyjwt.
Bumps the uv group with 2 updates in the /python/agents/small-business-loan-agent directory: nltk and pyjwt.
Bumps the uv group with 1 update in the /python/agents/software-bug-assistant directory: pyjwt.

Updates nltk from 3.9.4 to 3.10.0

Release notes

Sourced from nltk's releases.

v3.10.0-rc1

What's Changed

CHILDES corpus reader: lazy loading (fixes #1340) by @nschneid in nltk/nltk#1341

Stanseg by @casperlehmann in nltk/nltk#1350

Add optional CCG semantics computation by @tanin47 in nltk/nltk#1321

address of free software foundation updated by @Lightyagami1 in nltk/nltk#1347

Added a verification for empty tokens by @gnardari in nltk/nltk#1353

use data.load for vader lexicon by @afgiel in nltk/nltk#1303

Ensure that proper exceptions are caught correctly by @pombredanne in nltk/nltk#1343

Reset CCGVar everytime we invoke lexicon.fromstring() and skip the unicode test because it fails on python2.7 by @tanin47 in nltk/nltk#1354

Add tanin as an author :) by @tanin47 in nltk/nltk#1355

framenet.py: remove unnecessary str() call that causes problems for names with Unicode characters by @nschneid in nltk/nltk#1360

remove u because it doesn't work in Python 3.0 to 3.2 by @tanin47 in nltk/nltk#1362

moved the import for dispersion_plot out of the else block by @dennisobrien in nltk/nltk#1364

Raise warning for infinite recursion by @alvations in nltk/nltk#1365

Patch None TypeError in align_blocks() by @alvations in nltk/nltk#1366

Safer try-except for catching infinite recursion by @alvations in nltk/nltk#1368

Collections refactor by @nschneid in nltk/nltk#1382

Handles fringe cases in BLEU by @alvations in nltk/nltk#1383

Allow specifying substitution cost in edit distance by @dnc1994 in nltk/nltk#1386

Pl196x fixes by @pkasprzyk in nltk/nltk#1359

Docs/ngrams by @ColCarroll in nltk/nltk#1403

Fix conll.py by @germanferrero in nltk/nltk#1402

Aline by @geoffbacon in nltk/nltk#1407

Handle empty files in a corpus by @alexisdimi in nltk/nltk#1411

fixed bug: StackDecoder would throw exception if it's unable to finish… by @hikui in nltk/nltk#1405

add hikui to authors by @hikui in nltk/nltk#1412

removes download-cache pip flag from tox config by @fievelk in nltk/nltk#1415

Added three tokenizers, one detokenizer and two tokenizer-related word/char list corpora by @alvations in nltk/nltk#1282

Much faster Vader sentiment tagging by @georgeberry in nltk/nltk#1409

Fixes doctest in is_cjk() and REPP tokenizer wrapper by @alvations in nltk/nltk#1420

Fixed doctest for UnicharsCorpusReader and NonbreakingPrefixesCorpusReader by @alvations in nltk/nltk#1422

Updated senna version in docstring by @alvations in nltk/nltk#1431

Removes Python 2.6 and Python 3.1-3.3 code, Improves Python 3.5 syntax by @adamn in nltk/nltk#1429

Cleanup by @dimazest in nltk/nltk#1432

Fix zero division & log(0) in PunktTrainer._col_log_likelihood by @mrecachinas in nltk/nltk#1247

Update stanford_segmenter.py by @janissl in nltk/nltk#1444

explained data format for constructor by @drevicko in nltk/nltk#1450

Use a more efficient idiom for flattening nested lists by @rmalouf in nltk/nltk#1447

improved documentation of load_array() by @drevicko in nltk/nltk#1452

changed "list or iterator" to "sequence" by @drevicko in nltk/nltk#1453

Deal gracefully with degenerate cases. by @drevicko in nltk/nltk#1454

deal with (hopefully) all degenerate cases by @drevicko in nltk/nltk#1455

Enable unordered comparison for gaac clustering by @alvations in nltk/nltk#1456

Rewrite porter.py by @ExplodingCabbage in nltk/nltk#1261

Update naivebayes.py by @andyreagan in nltk/nltk#1461

Fixes bug where download status not returned. by @nsfabina in nltk/nltk#1468

Use lcon and rcon variables in conllned() when trace is False - Issue #1474 by @timleslie in nltk/nltk#1475

Use shutil.copyfileobj for unzipping by @ikorolev93 in nltk/nltk#1478

Fixing Chen&Cherry method 6 smoothing in BLEU score by @alvations in nltk/nltk#1477

... (truncated)

Changelog

Sourced from nltk's changelog.

Version 3.10.1 2026-07-29

Expand ~ in env-var paths

Validate types after WordNet app pickle deserialization

Fix uncontrolled search path in HunposTagger

Use exact thirds in masi_distance

Avoid retaining bllip import exceptions

Fix word_tokenize: pad opening single quote before multi-letter words.

Implement Tree.pformat_latex_forest.

Prevent module hijacking in inline imports.

Fix ReDoS in TweetTokenizer URL and email regexes.

Thanks to the following contributors to 3.10.1: Abhinav, Litesh Ghute, Eric Kafe, Eryk Kaźmierczak, Selim C., Muhtasim Munif Fahim, Triniti K., and Tom Y. Mitich.

Version 3.10.0 2026-06-11

Enforce the stricter nltk.pathsec security policy by default

Document the new security model and migration guidance

Harden resource loading against path traversal and SSRF/DNS-rebinding

Harden downloader path handling and block XML entity expansion

Close remaining corpus-reader security edge cases

Replace unsafe exec() usage in the utility CLI

Warn on unpickling user-provided pickles

Add HuggingFace datasets integration (nltk.huggingface)

Align TnT with Brants (2000) specifications

Fix PorterStemmer irregular-form lowercasing in NLTK mode

Fix TransitionParser sparse index dtype for scikit-learn 1.9

Fix TextCat tie handling

Fix WordNet object comparisons for incompatible types

Cache WordNet max depth lazily for lch_similarity()

Fix CCG variable direction, substitution, and type-raising bugs

Fix Jaro similarity for single-character and empty-string cases

Improve CI and release-maintenance workflows

Thanks to the following contributors to 3.10.0: 13rac1, alvations, bowiechen, devesh-2002, ekaf, elias-ba, haosenwang1018, HyperPS, ihitamandal, jancallewaert, jhnwnstd, JuanIMartinezB, Lemm1, LinZiyuu, Mr-Neutr0n, PastelStorm, scruge1, Syzygy2048, ylwango613, yzhaoinuw

Version 3.9.4 2026-03-24

Support Python 3.14

Fix bug in Levenshtein distance when substitution_cost > 2

Fix bug in Treebank detokeniser re quote ordering

Fix bug in Jaro similarity for empty strings

Several security enhancements

Fix GHSA-rf74-v2fm-23pw: unbounded recursion in JSONTaggedDecoder

... (truncated)

Commits

bd49f90 allow escaped brackets in Tree.fromstring (#3694)
27b8ad6 don't crash chomsky_normal_form on terminals with siblings (#3693)
52227d2 Use os.name for Windows path handling (#3605)
06c0e2c Avoid RIBES zero division on empty inputs (#3604)
a167389 Treat missing unzip output as stale (#3607)
c94c967 Fix EOF empty document bug in IEER corpus reader (#3648)
94a259c Enforce restrictive primitive type checking in pathsec wrappers (#3692)
5ac475d fix(security): isolate Stanford Java options and clean temp files (#3683)
986f26e ci(deps): bump the github-actions group with 3 updates (#3691)
f26b375 fix(security): prevent pickle RCE in TransitionParser model loading (CWE-502)...
Additional commits viewable in compare view

Updates pyjwt from 2.12.1 to 2.13.0

Release notes

Sourced from pyjwt's releases.

2.13.0

PyJWT 2.13.0 — Security Release

This release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.

Security

GHSA-xgmm-8j9v-c9wx — JWK JSON accepted as HMAC secret (algorithm confusion). HMACAlgorithm.prepare_key previously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms in algorithms=[…] and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. Reported by @aradona91.

GHSA-jq35-7prp-9v3f — Algorithm allow-list bypass with PyJWK / PyJWKClient. When verifying with a PyJWK, the caller's algorithms=[…] allow-list was checked against the token header alg as a string only; actual verification used the algorithm bound to the PyJWK. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token header alg to match the PyJWK's algorithm before verification. Reported by @sushi-gif.

GHSA-w7vc-732c-9m39 — DoS via base64 decode of unused payload segment when b64=false. For detached-payload JWS (b64=false), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplied detached_payload. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. Reported by @thesmartshadow.

GHSA-993g-76c3-p5m4 — PyJWKClient accepts non-HTTP(S) URIs. PyJWKClient.fetch_data passed its URI to urllib.request.urlopen, which by default also handles file://, ftp://, and data: schemes. An application that fed an attacker-influenced URI into PyJWKClient could be coerced into reading local files or reaching other unintended schemes. PyJWKClient now rejects any URI whose scheme isn't http or https. Reported by @KEIJOT.

GHSA-fhv5-28vv-h8m8 — PyJWKClient cache wiped on fetch error. A finally-block put(jwk_set=None) cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. Reported by @eddieran.

Fixed

Reject empty HMAC keys outright in HMACAlgorithm.prepare_key with InvalidKeyError instead of accepting them with only a warning. Defends against the os.getenv("JWT_SECRET", "") footgun. Thanks to @SnailSploit and @spartan8806 for the reports.

Forward per-call options (including enforce_minimum_key_length) from PyJWT.decode through to PyJWS._verify_signature. The option was previously silently dropped between the two layers, so it only took effect when set on the PyJWT instance. Thanks to @WLUB for the report.

RFC 7797 §3 compliance for b64=false: the encoder now auto-adds "b64" to crit, and the decoder rejects tokens that set b64=false without listing it in crit. Thanks to @MachineLearning-Nerd for the report.

Changed

Migrate the dev, docs, and tests package extras to dependency groups, by @kurtmckee in #1152.

Upgrade notes

Most fixes are invisible to correctly-configured callers. A few behavioral changes you may encounter:

Empty HMAC keys now raise. If your app passed "" or b"" as a secret (often via a missing env var, e.g. os.getenv("JWT_SECRET", "")), encode/decode will now raise InvalidKeyError. This is the intended behavior — fix the configuration.

PyJWK decoding now requires the token's alg to match the JWK's algorithm. Previously a mismatch was silently honored if the header alg appeared in the allow-list. Tokens that relied on this mismatch will now fail with InvalidAlgorithmError.

PyJWKClient now rejects non-HTTP(S) URIs at construction time. Tests or dev environments that fetched JWKS from file:// URIs need to switch to a local HTTP server or load the JWKS by other means (e.g. construct PyJWKSet.from_dict(...) directly).

b64=false tokens are now strictly RFC 7515 / 7797 compliant. Tokens with a non-empty compact-form payload segment, or that omit "b64" from crit, will be rejected. PyJWT-produced tokens always satisfy both invariants, so round-trips through PyJWT are unaffected.

enforce_minimum_key_length set per-call now takes effect. Callers who passed options={"enforce_minimum_key_length": True} to jwt.decode() previously got no enforcement; they will now get InvalidKeyError on undersized keys, as documented.

Full changelog: jpadilla/pyjwt@2.12.1...2.13.0

Changelog

Sourced from pyjwt's changelog.

`v2.13.0 <https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0>`__

Security


- Reject JWK JSON documents passed as raw HMAC secrets in
  ``HMACAlgorithm.prepare_key`` to close an algorithm-confusion gap that
  the existing PEM/SSH guard did not cover. Reported by @aradona91 in
  `GHSA-xgmm-8j9v-c9wx <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx>`__.
- Bind the JWT header ``alg`` to ``PyJWK.algorithm_name`` during
  verification so the caller's ``algorithms=[...]`` allow-list cannot be
  bypassed when decoding with a ``PyJWK`` / ``PyJWKClient`` key. Reported
  by @sushi-gif in `GHSA-jq35-7prp-9v3f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f>`__.
- Reject non-``http(s)`` URI schemes in ``PyJWKClient`` so attacker-
  influenced URIs cannot read local files or reach unintended schemes via
  urllib's default ``file://`` / ``ftp://`` / ``data:`` handlers. Reported
  by @KEIJOT in `GHSA-993g-76c3-p5m4 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4>`__.
- Preserve the cached JWK Set on fetch errors in ``PyJWKClient.fetch_data``.
  The previous ``finally``-block ``put(None)`` pattern cleared the cache
  on any transient outage, turning one bad JWKS request into application-
  wide auth failure. Reported by @eddieran in `GHSA-fhv5-28vv-h8m8 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8>`__.
- Skip the unconditional base64 decode of the compact-form payload segment
  when ``b64=false`` is set in the protected header, and require that
  segment to be empty (RFC 7515 Appendix F detached form). Closes an
  unauthenticated DoS amplifier. Reported by @thesmartshadow in
  `GHSA-w7vc-732c-9m39 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39>`__.
Fixed

- Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with
  ``InvalidKeyError`` instead of accepting them with only a warning.
  Thanks to @SnailSploit and @spartan8806 for independently flagging the
  footgun.
- Forward per-call ``options`` (including ``enforce_minimum_key_length``)
  from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the
  option actually takes effect when set at the call site rather than only
  on the ``PyJWT`` instance. Thanks to @WLUB for the report.
- RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds
  ``&quot;b64&quot;`` to the ``crit`` header parameter, and the decoder rejects
  tokens that set ``b64=false`` without listing it in ``crit``. Thanks to
  @MachineLearning-Nerd for the report.
Changed



Migrate the dev, docs, and tests package extras to dependency groups by @kurtmckee in [#1152](https://github.com/jpadilla/pyjwt/issues/1152) &lt;https://github.com/jpadilla/pyjwt/pull/1152&gt;__

Commits

7144e45 Apply ruff format
d2f4bec Restore cast() calls with cross-version type: ignore for prepare_key
22f478c Remove redundant casts in RSAAlgorithm.prepare_key and `ECAlgorithm.prepare...
95791b1 Bundle security fixes and hardening into 2.13.0
dcc27a9 [pre-commit.ci] pre-commit autoupdate (#1155)
9d08a9a [pre-commit.ci] pre-commit autoupdate (#1146)
b87c100 Bump codecov/codecov-action from 5 to 6 (#1154)
40e3147 Migrate development extras to dependency groups (#1152)
See full diff in compare view

Updates nltk from 3.9.4 to 3.10.0

Release notes

Sourced from nltk's releases.

v3.10.0-rc1

What's Changed

CHILDES corpus reader: lazy loading (fixes #1340) by @nschneid in nltk/nltk#1341

Stanseg by @casperlehmann in nltk/nltk#1350

Add optional CCG semantics computation by @tanin47 in nltk/nltk#1321

address of free software foundation updated by @Lightyagami1 in nltk/nltk#1347

Added a verification for empty tokens by @gnardari in nltk/nltk#1353

use data.load for vader lexicon by @afgiel in nltk/nltk#1303

Ensure that proper exceptions are caught correctly by @pombredanne in nltk/nltk#1343

Reset CCGVar everytime we invoke lexicon.fromstring() and skip the unicode test because it fails on python2.7 by @tanin47 in nltk/nltk#1354

Add tanin as an author :) by @tanin47 in nltk/nltk#1355

framenet.py: remove unnecessary str() call that causes problems for names with Unicode characters by @nschneid in nltk/nltk#1360

remove u because it doesn't work in Python 3.0 to 3.2 by @tanin47 in nltk/nltk#1362

moved the import for dispersion_plot out of the else block by @dennisobrien in nltk/nltk#1364

Raise warning for infinite recursion by @alvations in nltk/nltk#1365

Patch None TypeError in align_blocks() by @alvations in nltk/nltk#1366

Safer try-except for catching infinite recursion by @alvations in nltk/nltk#1368

Collections refactor by @nschneid in nltk/nltk#1382

Handles fringe cases in BLEU by @alvations in nltk/nltk#1383

Allow specifying substitution cost in edit distance by @dnc1994 in nltk/nltk#1386

Pl196x fixes by @pkasprzyk in nltk/nltk#1359

Docs/ngrams by @ColCarroll in nltk/nltk#1403

Fix conll.py by @germanferrero in nltk/nltk#1402

Aline by @geoffbacon in nltk/nltk#1407

Handle empty files in a corpus by @alexisdimi in nltk/nltk#1411

fixed bug: StackDecoder would throw exception if it's unable to finish… by @hikui in nltk/nltk#1405

add hikui to authors by @hikui in nltk/nltk#1412

removes download-cache pip flag from tox config by @fievelk in nltk/nltk#1415

Added three tokenizers, one detokenizer and two tokenizer-related word/char list corpora by @alvations in nltk/nltk#1282

Much faster Vader sentiment tagging by @georgeberry in nltk/nltk#1409

Fixes doctest in is_cjk() and REPP tokenizer wrapper by @alvations in nltk/nltk#1420

Fixed doctest for UnicharsCorpusReader and NonbreakingPrefixesCorpusReader by @alvations in nltk/nltk#1422

Updated senna version in docstring by @alvations in nltk/nltk#1431

Removes Python 2.6 and Python 3.1-3.3 code, Improves Python 3.5 syntax by @adamn in nltk/nltk#1429

Cleanup by @dimazest in nltk/nltk#1432

Fix zero division & log(0) in PunktTrainer._col_log_likelihood by @mrecachinas in nltk/nltk#1247

Update stanford_segmenter.py by @janissl in nltk/nltk#1444

explained data format for constructor by @drevicko in nltk/nltk#1450

Use a more efficient idiom for flattening nested lists by @rmalouf in nltk/nltk#1447

improved documentation of load_array() by @drevicko in nltk/nltk#1452

changed "list or iterator" to "sequence" by @drevicko in nltk/nltk#1453

Deal gracefully with degenerate cases. by @drevicko in nltk/nltk#1454

deal with (hopefully) all degenerate cases by @drevicko in nltk/nltk#1455

Enable unordered comparison for gaac clustering by @alvations in nltk/nltk#1456

Rewrite porter.py by @ExplodingCabbage in nltk/nltk#1261

Update naivebayes.py by @andyreagan in nltk/nltk#1461

Fixes bug where download status not returned. by @nsfabina in nltk/nltk#1468

Use lcon and rcon variables in conllned() when trace is False - Issue #1474 by @timleslie in nltk/nltk#1475

Use shutil.copyfileobj for unzipping by @ikorolev93 in nltk/nltk#1478

Fixing Chen&Cherry method 6 smoothing in BLEU score by @alvations in nltk/nltk#1477

... (truncated)

Changelog

Sourced from nltk's changelog.

Version 3.10.1 2026-07-29

Expand ~ in env-var paths

Validate types after WordNet app pickle deserialization

Fix uncontrolled search path in HunposTagger

Use exact thirds in masi_distance

Avoid retaining bllip import exceptions

Fix word_tokenize: pad opening single quote before multi-letter words.

Implement Tree.pformat_latex_forest.

Prevent module hijacking in inline imports.

Fix ReDoS in TweetTokenizer URL and email regexes.

Thanks to the following contributors to 3.10.1: Abhinav, Litesh Ghute, Eric Kafe, Eryk Kaźmierczak, Selim C., Muhtasim Munif Fahim, Triniti K., and Tom Y. Mitich.

Version 3.10.0 2026-06-11

Enforce the stricter nltk.pathsec security policy by default

Document the new security model and migration guidance

Harden resource loading against path traversal and SSRF/DNS-rebinding

Harden downloader path handling and block XML entity expansion

Close remaining corpus-reader security edge cases

Replace unsafe exec() usage in the utility CLI

Warn on unpickling user-provided pickles

Add HuggingFace datasets integration (nltk.huggingface)

Align TnT with Brants (2000) specifications

Fix PorterStemmer irregular-form lowercasing in NLTK mode

Fix TransitionParser sparse index dtype for scikit-learn 1.9

Fix TextCat tie handling

Fix WordNet object comparisons for incompatible types

Cache WordNet max depth lazily for lch_similarity()

Fix CCG variable direction, substitution, and type-raising bugs

Fix Jaro similarity for single-character and empty-string cases

Improve CI and release-maintenance workflows

Thanks to the following contributors to 3.10.0: 13rac1, alvations, bowiechen, devesh-2002, ekaf, elias-ba, haosenwang1018, HyperPS, ihitamandal, jancallewaert, jhnwnstd, JuanIMartinezB, Lemm1, LinZiyuu, Mr-Neutr0n, PastelStorm, scruge1, Syzygy2048, ylwango613, yzhaoinuw

Version 3.9.4 2026-03-24

Support Python 3.14

Fix bug in Levenshtein distance when substitution_cost > 2

Fix bug in Treebank detokeniser re quote ordering

Fix bug in Jaro similarity for empty strings

Several security enhancements

Fix GHSA-rf74-v2fm-23pw: unbounded recursion in JSONTaggedDecoder

... (truncated)

Commits

bd49f90 allow escaped brackets in Tree.fromstring (#3694)
27b8ad6 don't crash chomsky_normal_form on terminals with siblings (#3693)
52227d2 Use os.name for Windows path handling (#3605)
06c0e2c Avoid RIBES zero division on empty inputs (#3604)
a167389 Treat missing unzip output as stale (#3607)
c94c967 Fix EOF empty document bug in IEER corpus reader (#3648)
94a259c Enforce restrictive primitive type checking in pathsec wrappers (#3692)
5ac475d fix(security): isolate Stanford Java options and clean temp files (#3683)
986f26e ci(deps): bump the github-actions group with 3 updates (#3691)
f26b375 fix(security): prevent pickle RCE in TransitionParser model loading (CWE-502)...
Additional commits viewable in compare view

Updates pyjwt from 2.12.1 to 2.13.0

Release notes

Sourced from pyjwt's releases.

2.13.0

PyJWT 2.13.0 — Security Release

This release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.

Security

GHSA-xgmm-8j9v-c9wx — JWK JSON accepted as HMAC secret (algorithm confusion). HMACAlgorithm.prepare_key previously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms in algorithms=[…] and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. Reported by @aradona91.

GHSA-jq35-7prp-9v3f — Algorithm allow-list bypass with PyJWK / PyJWKClient. When verifying with a PyJWK, the caller's algorithms=[…] allow-list was checked against the token header alg as a string only; actual verification used the algorithm bound to the PyJWK. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token header alg to match the PyJWK's algorithm before verification. Reported by @sushi-gif.

GHSA-w7vc-732c-9m39 — DoS via base64 decode of unused payload segment when b64=false. For detached-payload JWS (b64=false), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplied detached_payload. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. Reported by @thesmartshadow.

GHSA-993g-76c3-p5m4 — PyJWKClient accepts non-HTTP(S) URIs. PyJWKClient.fetch_data passed its URI to urllib.request.urlopen, which by default also handles file://, ftp://, and data: schemes. An application that fed an attacker-influenced URI into PyJWKClient could be coerced into reading local files or reaching other unintended schemes. PyJWKClient now rejects any URI whose scheme isn't http or https. Reported by @KEIJOT.

GHSA-fhv5-28vv-h8m8 — PyJWKClient cache wiped on fetch error. A finally-block put(jwk_set=None) cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. Reported by @eddieran.

Fixed

Reject empty HMAC keys outright in HMACAlgorithm.prepare_key with InvalidKeyError instead of accepting them with only a warning. Defends against the os.getenv("JWT_SECRET", "") footgun. Thanks to @SnailSploit and @spartan8806 for the reports.

Forward per-call options (including enforce_minimum_key_length) from PyJWT.decode through to PyJWS._verify_signature. The option was previously silently dropped between the two layers, so it only took effect when set on the PyJWT instance. Thanks to @WLUB for the report.

RFC 7797 §3 compliance for b64=false: the encoder now auto-adds "b64" to crit, and the decoder rejects tokens that set b64=false without listing it in crit. Thanks to @MachineLearning-Nerd for the report.

Changed

Migrate the dev, docs, and tests package extras to dependency groups, by @kurtmckee in #1152.

Upgrade notes

Most fixes are invisible to correctly-configured callers. A few behavioral changes you may encounter:

Empty HMAC keys now raise. If your app passed "" or b"" as a secret (often via a missing env var, e.g. os.getenv("JWT_SECRET", "")), encode/decode will now raise InvalidKeyError. This is the intended behavior — fix the configuration.

PyJWK decoding now requires the token's alg to match the JWK's algorithm. Previously a mismatch was silently honored if the header alg appeared in the allow-list. Tokens that relied on this mismatch will now fail with InvalidAlgorithmError.

PyJWKClient now rejects non-HTTP(S) URIs at construction time. Tests or dev environments that fetched JWKS from file:// URIs need to switch to a local HTTP server or load the JWKS by other means (e.g. construct PyJWKSet.from_dict(...) directly).

b64=false tokens are now strictly RFC 7515 / 7797 compliant. Tokens with a non-empty compact-form payload segment, or that omit "b64" from crit, will be rejected. PyJWT-produced tokens always satisfy both invariants, so round-trips through PyJWT are unaffected.

enforce_minimum_key_length set per-call now takes effect. Callers who passed options={"enforce_minimum_key_length": True} to jwt.decode() previously got no enforcement; they will now get InvalidKeyError on undersized keys, as documented.

Full changelog: jpadilla/pyjwt@2.12.1...2.13.0

Changelog

Sourced from pyjwt's changelog.

`v2.13.0 <https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0>`__

Security


- Reject JWK JSON documents passed as raw HMAC secrets in
  ``HMACAlgorithm.prepare_key`` to close an algorithm-confusion gap that
  the existing PEM/SSH guard did not cover. Reported by @aradona91 in
  `GHSA-xgmm-8j9v-c9wx <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx>`__.
- Bind the JWT header ``alg`` to ``PyJWK.algorithm_name`` during
  verification so the caller's ``algorithms=[...]`` allow-list cannot be
  bypassed when decoding with a ``PyJWK`` / ``PyJWKClient`` key. Reported
  by @sushi-gif in `GHSA-jq35-7prp-9v3f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f>`__.
- Reject non-``http(s)`` URI schemes in ``PyJWKClient`` so attacker-
  influenced URIs cannot read local files or reach unintended schemes via
  urllib's default ``file://`` / ``ftp://`` / ``data:`` handlers. Reported
  by @KEIJOT in `GHSA-993g-76c3-p5m4 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4>`__.
- Preserve the cached JWK Set on fetch errors in ``PyJWKClient.fetch_data``.
  The previous ``finally``-block ``put(None)`` pattern cleared the cache
  on any transient outage, turning one bad JWKS request into application-
  wide auth failure. Reported by @eddieran in `GHSA-fhv5-28vv-h8m8 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8>`__.
- Skip the unconditional base64 decode of the compact-form payload segment
  when ``b64=false`` is set in the protected header, and require that
  segment to be empty (RFC 7515 Appendix F detached form). Closes an
  unauthenticated DoS amplifier. Reported by @thesmartshadow in
  `GHSA-w7vc-732c-9m39 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39>`__.
Fixed

- Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with
  ``InvalidKeyError`` instead of accepting them with only a warning.
  Thanks to @SnailSploit and @spartan8806 for independently flagging the
  footgun.
- Forward per-call ``options`` (including ``enforce_minimum_key_length``)
  from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the
  option actually takes effect when set at the call site rather than only
  on the ``PyJWT`` instance. Thanks to @WLUB for the report.
- RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds
  ``&quot;b64&quot;`` to the ``crit`` header parameter, and the decoder rejects
  tokens that set ``b64=false`` without listing it in ``crit``. Thanks to
  @MachineLearning-Nerd for the report.
Changed



Migrate the dev, docs, and tests package extras to dependency groups by @kurtmckee in [#1152](https://github.com/jpadilla/pyjwt/issues/1152) &lt;https://github.com/jpadilla/pyjwt/pull/1152&gt;__

Commits

7144e45 Apply ruff format
d2f4bec Restore cast() calls with cross-version type: ignore for prepare_key
22f478c Remove redundant casts in RSAAlgorithm.prepare_key and `ECAlgorithm.prepare...
95791b1 Bundle security fixes and hardening into 2.13.0
dcc27a9 [pre-commit.ci] pre-commit autoupdate (#1155)
9d08a9a [pre-commit.ci] pre-commit autoupdate (#1146)
b87c100 Bump codecov/codecov-action from 5 to 6 (#1154)
40e3147 Migrate development extras to dependency groups (#1152)
See full diff in compare view

Updates nltk from 3.9.4 to 3.10.0

Release notes

Sourced from nltk's releases.

v3.10.0-rc1

What's Changed

CHILDES corpus reader: lazy loading (fixes #1340) by @nschneid in nltk/nltk#1341

Stanseg by @casperlehmann in nltk/nltk#1350

Add optional CCG semantics computation by @tanin47 in nltk/nltk#1321

address of free software foundation updated by @Lightyagami1 in nltk/nltk#1347

Added a verification for empty tokens by @gnardari in nltk/nltk#1353

use data.load for vader lexicon by @afgiel in nltk/nltk#1303

Ensure that proper exceptions are caught correctly by @pombredanne in nltk/nltk#1343

Reset CCGVar everytime we invoke lexicon.fromstring() and skip the unicode test because it fails on python2.7 by @tanin47 in nltk/nltk#1354

Add tanin as an author :) by @tanin47 in nltk/nltk#1355

framenet.py: remove unnecessary str() call that causes problems for names with Unicode characters by @nschneid in nltk/nltk#1360

remove u because it doesn't work in Python 3.0 to 3.2 by @tanin47 in nltk/nltk#1362

moved the import for dispersion_plot out of the else block by @dennisobrien in nltk/nltk#1364

Raise warning for infinite recursion by @alvations in nltk/nltk#1365

Patch None TypeError in align_blocks() by @alvations in nltk/nltk#1366

Safer try-except for catching infinite recursion by @alvations in nltk/nltk#1368

Collections refactor by @nschneid in nltk/nltk#1382

Handles fringe cases in BLEU by @alvations in nltk/nltk#1383

Allow specifying substitution cost in edit distance by @dnc1994 in nltk/nltk#1386

Pl196x fixes by @pkasprzyk in nltk/nltk#1359

Docs/ngrams by @ColCarroll in nltk/nltk#1403

Fix conll.py by @germanferrero in nltk/nltk#1402

Aline ...
Description has been truncated

Bumps the uv group with 2 updates in the /python/agents/academic-research directory: [nltk](https://github.com/nltk/nltk) and [pyjwt](https://github.com/jpadilla/pyjwt). Bumps the uv group with 2 updates in the /python/agents/adk-ae-oauth directory: [nltk](https://github.com/nltk/nltk) and [pyjwt](https://github.com/jpadilla/pyjwt). Bumps the uv group with 2 updates in the /python/agents/brand-aligned-presentations directory: [nltk](https://github.com/nltk/nltk) and [pyjwt](https://github.com/jpadilla/pyjwt). Bumps the uv group with 2 updates in the /python/agents/brand-search-optimization directory: [nltk](https://github.com/nltk/nltk) and [pyjwt](https://github.com/jpadilla/pyjwt). Bumps the uv group with 1 update in the /python/agents/customer-service directory: [pyjwt](https://github.com/jpadilla/pyjwt). Bumps the uv group with 2 updates in the /python/agents/cyber-guardian-agent directory: [nltk](https://github.com/nltk/nltk) and [pyjwt](https://github.com/jpadilla/pyjwt). Bumps the uv group with 2 updates in the /python/agents/data-science directory: [nltk](https://github.com/nltk/nltk) and [pyjwt](https://github.com/jpadilla/pyjwt). Bumps the uv group with 1 update in the /python/agents/deep-search directory: [pyjwt](https://github.com/jpadilla/pyjwt). Bumps the uv group with 2 updates in the /python/agents/economic-research-agent directory: [nltk](https://github.com/nltk/nltk) and [pyjwt](https://github.com/jpadilla/pyjwt). Bumps the uv group with 2 updates in the /python/agents/fomc-research directory: [nltk](https://github.com/nltk/nltk) and [pyjwt](https://github.com/jpadilla/pyjwt). Bumps the uv group with 1 update in the /python/agents/genmedia-for-commerce directory: [pyjwt](https://github.com/jpadilla/pyjwt). Bumps the uv group with 2 updates in the /python/agents/global-kyc-agent directory: [nltk](https://github.com/nltk/nltk) and [pyjwt](https://github.com/jpadilla/pyjwt). Bumps the uv group with 2 updates in the /python/agents/high-volume-document-analyzer directory: [nltk](https://github.com/nltk/nltk) and [pyjwt](https://github.com/jpadilla/pyjwt). Bumps the uv group with 1 update in the /python/agents/image-scoring directory: [pyjwt](https://github.com/jpadilla/pyjwt). Bumps the uv group with 2 updates in the /python/agents/llm-auditor directory: [nltk](https://github.com/nltk/nltk) and [pyjwt](https://github.com/jpadilla/pyjwt). Bumps the uv group with 1 update in the /python/agents/marketing-agency directory: [nltk](https://github.com/nltk/nltk). Bumps the uv group with 2 updates in the /python/agents/memory-bank directory: [nltk](https://github.com/nltk/nltk) and [pyjwt](https://github.com/jpadilla/pyjwt). Bumps the uv group with 2 updates in the /python/agents/multiformat-hybrid-rag directory: [nltk](https://github.com/nltk/nltk) and [pyjwt](https://github.com/jpadilla/pyjwt). Bumps the uv group with 1 update in the /python/agents/nurse-handover directory: [pyjwt](https://github.com/jpadilla/pyjwt). Bumps the uv group with 2 updates in the /python/agents/on-brand-genmedia directory: [nltk](https://github.com/nltk/nltk) and [pyjwt](https://github.com/jpadilla/pyjwt). Bumps the uv group with 2 updates in the /python/agents/personalized-shopping directory: [nltk](https://github.com/nltk/nltk) and [pyjwt](https://github.com/jpadilla/pyjwt). Bumps the uv group with 1 update in the /python/agents/safety-plugins directory: [pyjwt](https://github.com/jpadilla/pyjwt). Bumps the uv group with 2 updates in the /python/agents/sdlc-task-planner directory: [nltk](https://github.com/nltk/nltk) and [pyjwt](https://github.com/jpadilla/pyjwt). Bumps the uv group with 2 updates in the /python/agents/sdlc-technical-designer directory: [nltk](https://github.com/nltk/nltk) and [pyjwt](https://github.com/jpadilla/pyjwt). Bumps the uv group with 2 updates in the /python/agents/sdlc-user-story-refiner directory: [nltk](https://github.com/nltk/nltk) and [pyjwt](https://github.com/jpadilla/pyjwt). Bumps the uv group with 2 updates in the /python/agents/small-business-loan-agent directory: [nltk](https://github.com/nltk/nltk) and [pyjwt](https://github.com/jpadilla/pyjwt). Bumps the uv group with 1 update in the /python/agents/software-bug-assistant directory: [pyjwt](https://github.com/jpadilla/pyjwt). Updates `nltk` from 3.9.4 to 3.10.0 - [Release notes](https://github.com/nltk/nltk/releases) - [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog) - [Commits](nltk/nltk@3.9.4...v3.10.0) Updates `pyjwt` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.12.1...2.13.0) Updates `nltk` from 3.9.4 to 3.10.0 - [Release notes](https://github.com/nltk/nltk/releases) - [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog) - [Commits](nltk/nltk@3.9.4...v3.10.0) Updates `pyjwt` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.12.1...2.13.0) Updates `nltk` from 3.9.4 to 3.10.0 - [Release notes](https://github.com/nltk/nltk/releases) - [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog) - [Commits](nltk/nltk@3.9.4...v3.10.0) Updates `pyjwt` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.12.1...2.13.0) Updates `nltk` from 3.9.4 to 3.10.0 - [Release notes](https://github.com/nltk/nltk/releases) - [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog) - [Commits](nltk/nltk@3.9.4...v3.10.0) Updates `pyjwt` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.12.1...2.13.0) Updates `pyjwt` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.12.1...2.13.0) Updates `nltk` from 3.9.4 to 3.10.0 - [Release notes](https://github.com/nltk/nltk/releases) - [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog) - [Commits](nltk/nltk@3.9.4...v3.10.0) Updates `pyjwt` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.12.1...2.13.0) Updates `nltk` from 3.9.4 to 3.10.0 - [Release notes](https://github.com/nltk/nltk/releases) - [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog) - [Commits](nltk/nltk@3.9.4...v3.10.0) Updates `pyjwt` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.12.1...2.13.0) Updates `pyjwt` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.12.1...2.13.0) Updates `nltk` from 3.9.4 to 3.10.0 - [Release notes](https://github.com/nltk/nltk/releases) - [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog) - [Commits](nltk/nltk@3.9.4...v3.10.0) Updates `pyjwt` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.12.1...2.13.0) Updates `nltk` from 3.9.4 to 3.10.0 - [Release notes](https://github.com/nltk/nltk/releases) - [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog) - [Commits](nltk/nltk@3.9.4...v3.10.0) Updates `pyjwt` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.12.1...2.13.0) Updates `pyjwt` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.12.1...2.13.0) Updates `nltk` from 3.9.4 to 3.10.0 - [Release notes](https://github.com/nltk/nltk/releases) - [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog) - [Commits](nltk/nltk@3.9.4...v3.10.0) Updates `pyjwt` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.12.1...2.13.0) Updates `nltk` from 3.9.4 to 3.10.0 - [Release notes](https://github.com/nltk/nltk/releases) - [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog) - [Commits](nltk/nltk@3.9.4...v3.10.0) Updates `pyjwt` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.12.1...2.13.0) Updates `pyjwt` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.12.1...2.13.0) Updates `nltk` from 3.9.4 to 3.10.0 - [Release notes](https://github.com/nltk/nltk/releases) - [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog) - [Commits](nltk/nltk@3.9.4...v3.10.0) Updates `pyjwt` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.12.1...2.13.0) Updates `nltk` from 3.9.4 to 3.10.0 - [Release notes](https://github.com/nltk/nltk/releases) - [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog) - [Commits](nltk/nltk@3.9.4...v3.10.0) Updates `nltk` from 3.9.4 to 3.10.0 - [Release notes](https://github.com/nltk/nltk/releases) - [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog) - [Commits](nltk/nltk@3.9.4...v3.10.0) Updates `pyjwt` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.12.1...2.13.0) Updates `nltk` from 3.9.4 to 3.10.0 - [Release notes](https://github.com/nltk/nltk/releases) - [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog) - [Commits](nltk/nltk@3.9.4...v3.10.0) Updates `pyjwt` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.12.1...2.13.0) Updates `pyjwt` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.12.1...2.13.0) Updates `nltk` from 3.9.4 to 3.10.0 - [Release notes](https://github.com/nltk/nltk/releases) - [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog) - [Commits](nltk/nltk@3.9.4...v3.10.0) Updates `pyjwt` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.12.1...2.13.0) Updates `nltk` from 3.9.4 to 3.10.0 - [Release notes](https://github.com/nltk/nltk/releases) - [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog) - [Commits](nltk/nltk@3.9.4...v3.10.0) Updates `pyjwt` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.12.1...2.13.0) Updates `pyjwt` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.12.1...2.13.0) Updates `nltk` from 3.9.4 to 3.10.0 - [Release notes](https://github.com/nltk/nltk/releases) - [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog) - [Commits](nltk/nltk@3.9.4...v3.10.0) Updates `pyjwt` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.12.1...2.13.0) Updates `nltk` from 3.9.4 to 3.10.0 - [Release notes](https://github.com/nltk/nltk/releases) - [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog) - [Commits](nltk/nltk@3.9.4...v3.10.0) Updates `pyjwt` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.12.1...2.13.0) Updates `nltk` from 3.9.4 to 3.10.0 - [Release notes](https://github.com/nltk/nltk/releases) - [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog) - [Commits](nltk/nltk@3.9.4...v3.10.0) Updates `pyjwt` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.12.1...2.13.0) Updates `nltk` from 3.9.4 to 3.10.0 - [Release notes](https://github.com/nltk/nltk/releases) - [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog) - [Commits](nltk/nltk@3.9.4...v3.10.0) Updates `pyjwt` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.12.1...2.13.0) Updates `pyjwt` from 2.12.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.12.1...2.13.0) --- updated-dependencies: - dependency-name: nltk dependency-version: 3.10.0 dependency-type: indirect dependency-group: uv - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: indirect dependency-group: uv - dependency-name: nltk dependency-version: 3.10.0 dependency-type: indirect dependency-group: uv - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: indirect dependency-group: uv - dependency-name: nltk dependency-version: 3.10.0 dependency-type: indirect dependency-group: uv - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: indirect dependency-group: uv - dependency-name: nltk dependency-version: 3.10.0 dependency-type: indirect dependency-group: uv - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: indirect dependency-group: uv - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: indirect dependency-group: uv - dependency-name: nltk dependency-version: 3.10.0 dependency-type: indirect dependency-group: uv - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: indirect dependency-group: uv - dependency-name: nltk dependency-version: 3.10.0 dependency-type: indirect dependency-group: uv - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: indirect dependency-group: uv - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: indirect dependency-group: uv - dependency-name: nltk dependency-version: 3.10.0 dependency-type: indirect dependency-group: uv - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: indirect dependency-group: uv - dependency-name: nltk dependency-version: 3.10.0 dependency-type: indirect dependency-group: uv - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: indirect dependency-group: uv - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: indirect dependency-group: uv - dependency-name: nltk dependency-version: 3.10.0 dependency-type: indirect dependency-group: uv - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: indirect dependency-group: uv - dependency-name: nltk dependency-version: 3.10.0 dependency-type: indirect dependency-group: uv - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: indirect dependency-group: uv - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: indirect dependency-group: uv - dependency-name: nltk dependency-version: 3.10.0 dependency-type: indirect dependency-group: uv - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: indirect dependency-group: uv - dependency-name: nltk dependency-version: 3.10.0 dependency-type: indirect dependency-group: uv - dependency-name: nltk dependency-version: 3.10.0 dependency-type: indirect dependency-group: uv - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: indirect dependency-group: uv - dependency-name: nltk dependency-version: 3.10.0 dependency-type: indirect dependency-group: uv - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: indirect dependency-group: uv - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: indirect dependency-group: uv - dependency-name: nltk dependency-version: 3.10.0 dependency-type: indirect dependency-group: uv - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: indirect dependency-group: uv - dependency-name: nltk dependency-version: 3.10.0 dependency-type: indirect dependency-group: uv - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: indirect dependency-group: uv - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: indirect dependency-group: uv - dependency-name: nltk dependency-version: 3.10.0 dependency-type: indirect dependency-group: uv - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: indirect dependency-group: uv - dependency-name: nltk dependency-version: 3.10.0 dependency-type: indirect dependency-group: uv - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: indirect dependency-group: uv - dependency-name: nltk dependency-version: 3.10.0 dependency-type: indirect dependency-group: uv - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: indirect dependency-group: uv - dependency-name: nltk dependency-version: 3.10.0 dependency-type: indirect dependency-group: uv - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: indirect dependency-group: uv - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: indirect dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot requested a review from happyhuman as a code owner August 1, 2026 03:06

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 1, 2026

This was referenced Aug 1, 2026

chore(deps): bump the uv group across 26 directories with 2 updates #2397

Closed

chore(deps): bump the uv group across 25 directories with 2 updates #2398

Closed

chore(deps): bump the uv group across 26 directories with 2 updates #2400

Closed

github-actions Bot approved these changes Aug 1, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the uv group across 27 directories with 2 updates - #2402

chore(deps): bump the uv group across 27 directories with 2 updates#2402
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python/agents/academic-research/uv-818267d5f6

dependabot Bot commented on behalf of github Aug 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 1, 2026

v3.10.0-rc1

What's Changed

2.13.0

PyJWT 2.13.0 — Security Release

Security

Fixed

Changed

Upgrade notes

v2.13.0 <https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0>__

v3.10.0-rc1

What's Changed

2.13.0

PyJWT 2.13.0 — Security Release

Security

Fixed

Changed

Upgrade notes

v2.13.0 <https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0>__

v3.10.0-rc1

What's Changed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`v2.13.0 <https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0>`__

`v2.13.0 <https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0>`__