Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-nltk for openSUSE:Factory checked in at 2026-08-24 16:20:14 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-nltk (Old) and /work/SRC/openSUSE:Factory/.python-nltk.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-nltk" Mon Aug 24 16:20:14 2026 rev:26 rq:1373371 version:3.10.3 Changes: -------- --- /work/SRC/openSUSE:Factory/python-nltk/python-nltk.changes 2026-08-13 13:16:58.488419675 +0200 +++ /work/SRC/openSUSE:Factory/.python-nltk.new.1258/python-nltk.changes 2026-08-24 16:20:16.637687951 +0200 @@ -1,0 +2,24 @@ +Mon Aug 24 10:20:56 UTC 2026 - Daniel Garcia <[email protected]> + +- Update to 3.10.3 (CVE-2026-71513, bsc#1276253, CVE-2026-71514, bsc#1276252): + * docs: wrap Chat-80 HOWTO output + * Sandbox Stanford JAR execution to nltk_data directories + * Harden path-traversal / file-I/O sandbox: close write-side symlink + TOCTOU + shared-temp squat, lock the cluster with a living audit + (CWE-22/59/377) + * Extend algorithmic-complexity DoS hardening: repo-wide sweep + + two-string distances (CWE-407/CWE-400) + * Bound unbounded-work DoS in parsers and grammar transforms + (CWE-407/674/835) + * fix(security): sandbox MaltParser's Java execution + (CVE-2026-12252, CVE-2026-12841) + * fix(security): trust the system temp dir only when it is private + (CWE-377/CWE-378) + * fix(security): validate corpus-reader roots against the data + sandbox (CWE-73) + * fix(security): validate per-call java() options and replace the + -XX:/-D allowlist with a minimal one (CWE-88) + * Additional security hardening (CWE-407, CWE-426, CWE-427, CWE-502, + CWE-59, CWE-776, CWE-918) + +------------------------------------------------------------------- Old: ---- nltk-3.10.2.obscpio New: ---- nltk-3.10.3.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-nltk.spec ++++++ --- /var/tmp/diff_new_pack.YmftsA/_old 2026-08-24 16:20:17.519719016 +0200 +++ /var/tmp/diff_new_pack.YmftsA/_new 2026-08-24 16:20:17.521719086 +0200 @@ -19,7 +19,7 @@ %define modname nltk %{?sle15_python_module_pythons} Name: python-nltk -Version: 3.10.2 +Version: 3.10.3 Release: 0 Summary: Natural Language Toolkit License: Apache-2.0 @@ -97,6 +97,7 @@ # /SECTION Requires: python-regex >= 2021.8.3 Requires: python-click +Requires: python-defusedxml Requires: python-joblib Requires: python-tqdm Recommends: python-gensim ++++++ _service ++++++ --- /var/tmp/diff_new_pack.YmftsA/_old 2026-08-24 16:20:17.561720495 +0200 +++ /var/tmp/diff_new_pack.YmftsA/_new 2026-08-24 16:20:17.567720707 +0200 @@ -3,8 +3,8 @@ <param name="url">https://github.com/nltk/nltk</param> <param name="scm">git</param> <param name="exclude">web/*</param> - <param name="version">3.10.2</param> - <param name="revision">v3.10.2</param> + <param name="version">3.10.3</param> + <param name="revision">v3.10.3</param> </service> <service mode="manual" name="set_version" /> <service mode="buildtime" name="tar" /> ++++++ nltk-3.10.2.obscpio -> nltk-3.10.3.obscpio ++++++ ++++ 7874 lines of diff (skipped) ++++++ nltk.obsinfo ++++++ --- /var/tmp/diff_new_pack.YmftsA/_old 2026-08-24 16:20:18.163741698 +0200 +++ /var/tmp/diff_new_pack.YmftsA/_new 2026-08-24 16:20:18.167741839 +0200 @@ -1,5 +1,5 @@ name: nltk -version: 3.10.2 -mtime: 1785917783 -commit: 474af1f5a94b1b8d53fc2b6defec3a2ce7633b74 +version: 3.10.3 +mtime: 1786571315 +commit: 303f6e2ba8e4548a5f54fd65d86bb5c9a949f1db
