[arekay-nv]

What does this PR do?

Bumps the three root-lock packages that have open Dependabot alerts with a
fixed release available in the dev / test tooling extras, and drops the
nltk pip-audit ignore now that a fixed nltk release has shipped.

Package	Previous	Updated	How it's pulled in	Advisories
nltk	3.10.3	3.10.4	Direct rouge pin (via test)	CVE-2026-81726 / PYSEC-2026-3740, GHSA-j456-xh4h-cpf2 (fixed in 3.10.4)
msgpack	1.2.1	1.2.3	Transitive (pip-audit -> cachecontrol)	CVE-2026-114613 (fixed in 1.2.3)
virtualenv	21.14.10	21.14.13	Direct dev pin, plus pre-commit	CVE-2026-115586 (fixed in 21.14.13)

Changes

• pyproject.toml: nltk==3.10.4 (rouge), virtualenv==21.14.13 (dev),
  and a new dev pin msgpack==1.2.3 next to the existing pip==26.2 pin,
  which covers the same pip-audit dependency chain. The pin (rather than a
  [tool.uv] constraint-dependencies floor) means pip installs get the fix too.
• uv.lock: relocked. The three versions above are the only changes; no
  packages added or removed.
• .github/workflows/test.yml, AGENTS.md, docs/DEVELOPMENT.md: drop
  --ignore-vuln PYSEC-2026-3740 and the related notes. With nltk 3.10.4,
  pip-audit reports nothing, ignores or not.

Out of scope

The remaining root-lock alerts are all in the bfcl resolution fork
(bfcl-eval's old pins: pyasn1, datamodel-code-generator, filelock 3.20.0,
black, cryptography, dnspython, soupsieve, torch). The isolated subproject
locks (swebench_service, legacy_mlperf_deepseek_r1, the WAN 2.2 accuracy
example) are also not touched here.

Type of change

• Bug fix

Related issues

Closes #520

Supersedes #551, which fixes only msgpack (CVE-2026-114613) via a
[tool.uv] constraint-dependencies floor (msgpack>=1.2.3). This PR
carries the same msgpack fix as an exact dev pin, so pip installs get it
too, and also covers nltk and virtualenv.

Testing

• Synced the same extras as the CI audit job
  (--extra dev --extra test --extra performance), then ran
  uv run pip-audit with no ignores: no known vulnerabilities.
• uv lock --check and uv pip check: all 143 installed packages
  compatible.
• RougeScorer(use_stemmer=True) smoke test on nltk 3.10.4;
  tests/unit/evaluation/test_accuracy_results.py passes.
• Ran CI's test selection (-m "not slow and not performance") on macOS:
  2599 passed, 55 failed. All 55 are macOS-only (CPU affinity requires
  Linux: pin_loadgen() requires Linux, no /proc). The failing set is
  identical with main's lock, same as noted in fix(deps): update filelock, setuptools, and virtualenv for security fixes #546.

Checklist

• Code follows project style
• Pre-commit hooks pass (mypy on macOS reports the known
  os.sched_setaffinity platform errors in untouched files)
• Documentation updated (if needed)

🤖 Generated with Claude Code

[github-actions]

MLCommons CLA bot All contributors have signed the MLCommons CLA ✍️ ✅

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@4b385eb). Learn more about missing BASE report.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #557   +/-   ##
=======================================
  Coverage        ?   81.37%           
=======================================
  Files           ?      157           
  Lines           ?    22472           
  Branches        ?        0           
=======================================
  Hits            ?    18286           
  Misses          ?     4186           
  Partials        ?        0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.