LCORE-4062: Fixed CVE found in NLTK package

[tisnik]

Description

LCORE-4062: Fixed CVE found in NLTK package

Type of change

• Refactor
• New feature
• Bug fix
• CVE fix
• Optimization
• Documentation Update
• Configuration Update
• Bump-up service version
• Bump-up dependent library [pyproject.toml + uv.lock]
• Bump-up dependent library [requirements.*.txt for Konflux]
• Bump-up library or tool used for development (does not change the final image)
• CI configuration change
• Konflux configuration change
• Unit tests improvement
• Integration tests improvement
• End to end tests improvement
• Benchmarks improvement

Tools used to create PR

• Assisted-by: N/A
• Generated by: N/A

Related Tickets & Documents

• Related Issue #LCORE-4062

Summary by CodeRabbit

• Chores
  • Updated the pinned NLTK dependency to version 3.10.3.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 8a0b2161-004c-4f73-b5b6-f333a15b72cc

📥 Commits

Reviewing files that changed from the base of the PR and between ff9ca46 and 47700e0.

📒 Files selected for processing (1)

• .konflux/requirements.hashes.wheel.txt

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (25)

• GitHub Check: E2E: server / ci / authorized
• GitHub Check: E2E: server / ci / other
• GitHub Check: E2E: library / ci / skills
• GitHub Check: E2E: library / ci / default
• GitHub Check: E2E: library / ci / shields
• GitHub Check: E2E: library / ci / rbac
• GitHub Check: E2E: server / ci / default
• GitHub Check: E2E: server / ci / tls
• GitHub Check: E2E: library / ci / other
• GitHub Check: E2E: library / ci / mcp
• GitHub Check: E2E: server / ci / rbac
• GitHub Check: E2E: server / ci / skills
• GitHub Check: E2E: server / ci / mcp
• GitHub Check: E2E: library / ci / authorized
• GitHub Check: E2E: server / ci / shields
• GitHub Check: Red Hat Konflux / lightspeed-stack-0-8-e2e-tests / lightspeed-stack-0-8
• GitHub Check: Red Hat Konflux / lightspeed-core-0-8-enterprise-contract / lightspeed-stack-0-8
• GitHub Check: Red Hat Konflux / rag-content-0-8-e2e-tests / lightspeed-stack-0-8
• GitHub Check: Konflux kflux-prd-rh02 / lightspeed-stack-0-8-on-pull-request
• GitHub Check: Pylinter
• GitHub Check: integration_tests (3.12)
• GitHub Check: unit_tests (3.12)
• GitHub Check: build-pr
• GitHub Check: unit_tests (3.13)
• GitHub Check: integration_tests (3.13)

🔇 Additional comments (2)

.konflux/requirements.hashes.wheel.txt (2)

218-218: 🔒 Security & Privacy | 🛡️ Analyzed with Security Review

Document the advisory targeted by LCORE-4062.

The repository pins NLTK 3.10.3 from the Red Hat RHOAI index and contains no direct calls to the affected model-artifact APIs. Identify the target advisory and confirm whether any runtime provider reaches those APIs before assessing residual exposure.

---

219-219: 🗄️ Data Integrity & Integration

Do not replace the hash with the PyPI hash.

The Konflux file is generated from and installed with the Red Hat RHOAI index. uv.lock records a different PyPI artifact, so its ff9598a8... hash does not prove that the RHOAI hash is invalid.

---

Walkthrough

The pinned nltk dependency was updated from 3.10.0 to 3.10.3, along with its wheel hash.

Changes

NLTK dependency update

Layer / File(s)	Summary
Update NLTK pin .konflux/requirements.hashes.wheel.txt	The pinned nltk version and associated SHA-256 wheel hash were updated.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: 🟠 High · up to 47700

The NLTK security update is not merge-ready because its pinned wheel digest is incorrect and can break hash-enforced builds or deployments.

Suggested reviewers: syedriko

🚥 Pre-merge checks | ✅ 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the CVE fix in the NLTK package and includes the tracking issue identifier. It accurately describes the primary change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Performance And Algorithmic Complexity	✅ Passed	PASS. The pull request changes only .konflux/requirements.hashes.wheel.txt. It updates nltk from 3.10.0 to 3.10.3 and replaces the wheel hash. It adds no algorithms, loops, API calls, list operati…
Security And Secret Handling	✅ Passed	PASSED. The pull request changes only .konflux/requirements.hashes.wheel.txt. It updates nltk from 3.10.0 to 3.10.3 and replaces the package hash. No source code, API endpoint, authentication,…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}