From 0f7e6e14ab34ba22d66e0678e47aa854c977f24f Mon Sep 17 00:00:00 2001
From: Mark Backman <mark@daily.co>
Date: Tue, 24 Feb 2026 08:54:03 -0500
Subject: [PATCH] Bump nltk minimum version from 3.9.1 to 3.9.3

Resolves a security vulnerability flagged by Dependabot (#164).
---
 changelog/3811.changed.md | 1 +
 pyproject.toml            | 2 +-
 uv.lock                   | 8 ++++----
 3 files changed, 6 insertions(+), 5 deletions(-)
 create mode 100644 changelog/3811.changed.md

diff --git a/changelog/3811.changed.md b/changelog/3811.changed.md
new file mode 100644
index 000000000..eb3eb492e
--- /dev/null
+++ b/changelog/3811.changed.md
@@ -0,0 +1 @@
+- Bumped `nltk` minimum version from 3.9.1 to 3.9.3 to resolve a security vulnerability.
diff --git a/pyproject.toml b/pyproject.toml
index 63ff02c06..a45ebb3b3 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -26,7 +26,7 @@ dependencies = [
     "docstring_parser~=0.16",
     "loguru~=0.7.3",
     "Markdown>=3.7,<4",
-    "nltk>=3.9.1,<4",
+    "nltk>=3.9.3,<4",
     "numpy>=1.26.4,<3",
     "Pillow>=11.1.0,<13",
     "protobuf~=5.29.6",
diff --git a/uv.lock b/uv.lock
index c7adf5406..bd2f64639 100644
--- a/uv.lock
+++ b/uv.lock
@@ -3686,7 +3686,7 @@ wheels = [
 
 [[package]]
 name = "nltk"
-version = "3.9.2"
+version = "3.9.3"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "click" },
@@ -3694,9 +3694,9 @@ dependencies = [
     { name = "regex" },
     { name = "tqdm" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/f9/76/3a5e4312c19a028770f86fd7c058cf9f4ec4321c6cf7526bab998a5b683c/nltk-3.9.2.tar.gz", hash = "sha256:0f409e9b069ca4177c1903c3e843eef90c7e92992fa4931ae607da6de49e1419", size = 2887629, upload-time = "2025-10-01T07:19:23.764Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e1/8f/915e1c12df07c70ed779d18ab83d065718a926e70d3ea33eb0cd66ffb7c0/nltk-3.9.3.tar.gz", hash = "sha256:cb5945d6424a98d694c2b9a0264519fab4363711065a46aa0ae7a2195b92e71f", size = 2923673, upload-time = "2026-02-24T12:05:53.833Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/60/90/81ac364ef94209c100e12579629dc92bf7a709a84af32f8c551b02c07e94/nltk-3.9.2-py3-none-any.whl", hash = "sha256:1e209d2b3009110635ed9709a67a1a3e33a10f799490fa71cf4bec218c11c88a", size = 1513404, upload-time = "2025-10-01T07:19:21.648Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/7e/9af5a710a1236e4772de8dfcc6af942a561327bb9f42b5b4a24d0cf100fd/nltk-3.9.3-py3-none-any.whl", hash = "sha256:60b3db6e9995b3dd976b1f0fa7dec22069b2677e759c28eb69b62ddd44870522", size = 1525385, upload-time = "2026-02-24T12:05:46.54Z" },
 ]
 
 [[package]]
@@ -4692,7 +4692,7 @@ requires-dist = [
     { name = "mcp", extras = ["cli"], marker = "extra == 'mcp'", specifier = ">=1.11.0,<2" },
     { name = "mem0ai", marker = "extra == 'mem0'", specifier = "~=0.1.94" },
     { name = "mlx-whisper", marker = "extra == 'mlx-whisper'", specifier = "~=0.4.2" },
-    { name = "nltk", specifier = ">=3.9.1,<4" },
+    { name = "nltk", specifier = ">=3.9.3,<4" },
     { name = "noisereduce", marker = "extra == 'noisereduce'", specifier = "~=3.0.3" },
     { name = "numba", specifier = "==0.61.2" },
     { name = "numpy", specifier = ">=1.26.4,<3" },