Rip&Tear de4b55cf79 ci: whitelist nltk PYSEC-2026-597 in pip-audit (no fix available) ...

nltk 3.9.4 path-traversal advisory (percent-encoded sequences bypassing
the data.load()/find() check; incomplete fix for nltk#3504). 3.9.4 is the
latest release and the advisory lists no fixed version, so the pin cannot be
bumped to clear it. nltk is transitive via unstructured and crewai never
calls nltk.data.load()/find() with untrusted input. Mirrors the existing
PYSEC-2026-97 nltk ignore.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-03 15:22:09 +08:00

..

build-uv-cache.yml

ci: pin third-party actions to commit SHAs (#5869)

2026-05-21 18:08:34 -05:00

codeql.yml

ci: pin third-party actions to commit SHAs (#5869)

2026-05-21 18:08:34 -05:00

docs-broken-links.yml

Restrict docs broken-links workflow permissions (#6330)

2026-06-25 10:52:33 +08:00

generate-tool-specs.yml

ci: pin third-party actions to commit SHAs (#5869)

2026-05-21 18:08:34 -05:00

linter.yml

ci: pin third-party actions to commit SHAs (#5869)

2026-05-21 18:08:34 -05:00

nightly.yml

ci: pin third-party actions to commit SHAs (#5869)

2026-05-21 18:08:34 -05:00

pr-size.yml

ci: pin third-party actions to commit SHAs

2026-05-20 19:01:53 +08:00

pr-title.yml

ci: pin third-party actions to commit SHAs

2026-05-20 19:01:53 +08:00

publish.yml

ci: pin third-party actions to commit SHAs (#5869)

2026-05-21 18:08:34 -05:00

stale.yml

ci: pin third-party actions to commit SHAs (#5869)

2026-05-21 18:08:34 -05:00

tests.yml

ci: pin third-party actions to commit SHAs (#5869)

2026-05-21 18:08:34 -05:00

type-checker.yml

ci: pin third-party actions to commit SHAs (#5869)

2026-05-21 18:08:34 -05:00

update-test-durations.yml

ci: pin third-party actions to commit SHAs (#5869)

2026-05-21 18:08:34 -05:00

vulnerability-scan.yml

ci: whitelist nltk PYSEC-2026-597 in pip-audit (no fix available)

2026-07-03 15:22:09 +08:00