chore(deps): bump nltk from 3.9.4 to 3.10.0

[dependabot]

Bumps nltk from 3.9.4 to 3.10.0.

Release notes

Sourced from nltk's releases.

v3.10.0-rc1

What's Changed

• CHILDES corpus reader: lazy loading (fixes #1340) by @​nschneid in nltk/nltk#1341
• Stanseg by @​casperlehmann in nltk/nltk#1350
• Add optional CCG semantics computation by @​tanin47 in nltk/nltk#1321
• address of free software foundation updated by @​Lightyagami1 in nltk/nltk#1347
• Added a verification for empty tokens by @​gnardari in nltk/nltk#1353
• use data.load for vader lexicon by @​afgiel in nltk/nltk#1303
• Ensure that proper exceptions are caught correctly by @​pombredanne in nltk/nltk#1343
• Reset CCGVar everytime we invoke lexicon.fromstring() and skip the unicode test because it fails on python2.7 by @​tanin47 in nltk/nltk#1354
• Add tanin as an author :) by @​tanin47 in nltk/nltk#1355
• framenet.py: remove unnecessary str() call that causes problems for names with Unicode characters by @​nschneid in nltk/nltk#1360
• remove u because it doesn't work in Python 3.0 to 3.2 by @​tanin47 in nltk/nltk#1362
• moved the import for dispersion_plot out of the else block by @​dennisobrien in nltk/nltk#1364
• Raise warning for infinite recursion by @​alvations in nltk/nltk#1365
• Patch None TypeError in align_blocks() by @​alvations in nltk/nltk#1366
• Safer try-except for catching infinite recursion by @​alvations in nltk/nltk#1368
• Collections refactor by @​nschneid in nltk/nltk#1382
• Handles fringe cases in BLEU by @​alvations in nltk/nltk#1383
• Allow specifying substitution cost in edit distance by @​dnc1994 in nltk/nltk#1386
• Pl196x fixes by @​pkasprzyk in nltk/nltk#1359
• Docs/ngrams by @​ColCarroll in nltk/nltk#1403
• Fix conll.py by @​germanferrero in nltk/nltk#1402
• Aline by @​geoffbacon in nltk/nltk#1407
• Handle empty files in a corpus by @​alexisdimi in nltk/nltk#1411
• fixed bug: StackDecoder would throw exception if it's unable to finish… by @​hikui in nltk/nltk#1405
• add hikui to authors by @​hikui in nltk/nltk#1412
• removes download-cache pip flag from tox config by @​fievelk in nltk/nltk#1415
• Added three tokenizers, one detokenizer and two tokenizer-related word/char list corpora by @​alvations in nltk/nltk#1282
• Much faster Vader sentiment tagging by @​georgeberry in nltk/nltk#1409
• Fixes doctest in is_cjk() and REPP tokenizer wrapper by @​alvations in nltk/nltk#1420
• Fixed doctest for UnicharsCorpusReader and NonbreakingPrefixesCorpusReader by @​alvations in nltk/nltk#1422
• Updated senna version in docstring by @​alvations in nltk/nltk#1431
• Removes Python 2.6 and Python 3.1-3.3 code, Improves Python 3.5 syntax by @​adamn in nltk/nltk#1429
• Cleanup by @​dimazest in nltk/nltk#1432
• Fix zero division & log(0) in PunktTrainer._col_log_likelihood by @​mrecachinas in nltk/nltk#1247
• Update stanford_segmenter.py by @​janissl in nltk/nltk#1444
• explained data format for constructor by @​drevicko in nltk/nltk#1450
• Use a more efficient idiom for flattening nested lists by @​rmalouf in nltk/nltk#1447
• improved documentation of load_array() by @​drevicko in nltk/nltk#1452
• changed "list or iterator" to "sequence" by @​drevicko in nltk/nltk#1453
• Deal gracefully with degenerate cases. by @​drevicko in nltk/nltk#1454
• deal with (hopefully) all degenerate cases by @​drevicko in nltk/nltk#1455
• Enable unordered comparison for gaac clustering by @​alvations in nltk/nltk#1456
• Rewrite porter.py by @​ExplodingCabbage in nltk/nltk#1261
• Update naivebayes.py by @​andyreagan in nltk/nltk#1461
• Fixes bug where download status not returned. by @​nsfabina in nltk/nltk#1468
• Use lcon and rcon variables in conllned() when trace is False - Issue #1474 by @​timleslie in nltk/nltk#1475
• Use shutil.copyfileobj for unzipping by @​ikorolev93 in nltk/nltk#1478
• Fixing Chen&Cherry method 6 smoothing in BLEU score by @​alvations in nltk/nltk#1477

... (truncated)

Changelog

Sourced from nltk's changelog.

Version 3.10.0 2026-06-11

• Enforce the stricter nltk.pathsec security policy by default
• Document the new security model and migration guidance
• Harden resource loading against path traversal and SSRF/DNS-rebinding
• Harden downloader path handling and block XML entity expansion
• Close remaining corpus-reader security edge cases
• Replace unsafe exec() usage in the utility CLI
• Warn on unpickling user-provided pickles
• Add HuggingFace datasets integration (nltk.huggingface)
• Align TnT with Brants (2000) specifications
• Fix PorterStemmer irregular-form lowercasing in NLTK mode
• Fix TransitionParser sparse index dtype for scikit-learn 1.9
• Fix TextCat tie handling
• Fix WordNet object comparisons for incompatible types
• Cache WordNet max depth lazily for lch_similarity()
• Fix CCG variable direction, substitution, and type-raising bugs
• Fix Jaro similarity for single-character and empty-string cases
• Improve CI and release-maintenance workflows

Thanks to the following contributors to 3.10.0: 13rac1, alvations, bowiechen, devesh-2002, ekaf, elias-ba, haosenwang1018, HyperPS, ihitamandal, jancallewaert, jhnwnstd, JuanIMartinezB, Lemm1, LinZiyuu, Mr-Neutr0n, PastelStorm, scruge1, Syzygy2048, ylwango613, yzhaoinuw

Version 3.9.4 2026-03-24

• Support Python 3.14
• Fix bug in Levenshtein distance when substitution_cost > 2
• Fix bug in Treebank detokeniser re quote ordering
• Fix bug in Jaro similarity for empty strings
• Several security enhancements
• Fix GHSA-rf74-v2fm-23pw: unbounded recursion in JSONTaggedDecoder
• Implement TextTiling vocabulary introduction method (Hearst 1997)
• Fix ALINE feature matrix errors and add comprehensive tests
• Support multiple VerbNet versions, fix longid/shortid regex for VerbNet ids
• Let downloader fallback to md5 when sha256 is unavailable
• Several other minor bugfixes and code cleanups

Thanks to the following contributors to 3.9.4: Min-Yen Kan, Eric Kafe, Emily Voss, bowiechen, Hrudhai01, jancallewaert, Mr-Neutr0n, pollak.peter89, ylwango613,

Version 3.9.3 2026-02-21

• Fix CVE-2025-14009: secure ZIP extraction in nltk.downloader (#3468)
• Block path traversal/arbitrary reads in nltk.data for protocol-less refs (#3467)
• Block path traversal/abs paths in corpus readers and FS pointers (#3479, #3480)
• Validate external StanfordSegmenter JARs using SHA256 (#3477)

... (truncated)

Commits

• bd49f90 allow escaped brackets in Tree.fromstring (#3694)
• 27b8ad6 don't crash chomsky_normal_form on terminals with siblings (#3693)
• 52227d2 Use os.name for Windows path handling (#3605)
• 06c0e2c Avoid RIBES zero division on empty inputs (#3604)
• a167389 Treat missing unzip output as stale (#3607)
• c94c967 Fix EOF empty document bug in IEER corpus reader (#3648)
• 94a259c Enforce restrictive primitive type checking in pathsec wrappers (#3692)
• 5ac475d fix(security): isolate Stanford Java options and clean temp files (#3683)
• 986f26e ci(deps): bump the github-actions group with 3 updates (#3691)
• f26b375 fix(security): prevent pickle RCE in TransitionParser model loading (CWE-502)...
• Additional commits viewable in compare view