NRCL-103 Require patched NLTK in the optional sentiment extra

[hudsonaikins]

Summary

The optional sentiment extra could install NLTK versions affected by three critical advisories through TextBlob. Require nltk>=3.10.3 in that extra and update the lockfile from 3.9.3 to 3.10.3. TextBlob stays at 0.19.0 in the lockfile; the only added package is NLTK's required defusedxml==0.7.1.

Add a focused smoke test through SentimentAnalyzer(TEXTBLOB): positive and negative results must use TextBlob while socket connections, DNS lookup, corpus downloads, and external NLTK corpus paths are blocked.

NRCL-103

Validation

Candidate: a6e223174b1edce5f05d767a2cdf719914ac72a2; base: 5fbca25efa95c288e8770cee44c2042ef54ec12b.

• Python 3.10: uv sync --locked --extra dev --python 3.10 passed.
• Ruff and Mypy passed (80 source files).
• Required Black command passed; its existing include pattern selects zero files, so the new test also passed an explicit --include '\.pyi?$' --target-version py310 formatting check.
• Full Pytest: 411 passed, 8 skipped. Two skips are the optional smoke cases because the default development environment excludes TextBlob/NLTK.
• Optional smoke: uv run --no-sync --with textblob==0.19.0 --with nltk==3.10.3 pytest tests/test_sentiment_textblob.py -q --no-cov — 2 passed on Python 3.10.
• Built wheel metadata retains Requires-Python: >=3.10 and scopes the NLTK and TextBlob requirements to extra == "sentiment".
• Lockfile comparison confirms no unrelated package upgrades.

Hosted review

• CI passed on the candidate across Python 3.10, 3.11, and 3.12.
• Security Scan advisory jobs and Documentation Check passed. Conditional Require Documentation was skipped.
• Codex review reported no major issues for a6e223174b.

Advisory basis and limits

NLTK 3.10.3 is outside the affected ranges for GHSA-x99w-6fgc-pmfw, GHSA-rhp5-r9x4-f5g2, and GHSA-m4rf-3fr8-xwx3. PyPI's 3.10.3 metadata supports Python >=3.10.

No sentiment removal, downloaded models, live service calls, release, or deployment. The smoke covers the TextBlob path; it does not claim to validate every optional sentiment engine. Existing installations need the updated package requirements or lockfile to receive the fix.

[github-actions]

📚 Documentation Status

ℹ️ No documentation-related changes detected

---

This comment is automatically generated by the documentation workflow.

[hudsonaikins]

@codex review

[makeplane]

Linked to Plane Work Item(s)

• (NRCL-103) Remove critical NLTK exposure from the optional sentiment extra

This comment was auto-generated by Plane

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: a6e223174b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".