security: bump nltk to >=3.10.0 in iheval and rolemrc

fern/versions/latest/pages/infrastructure/sandbox/ecs-fargate.mdx

@@ -108,10 +108,7 @@ asyncio.run(main())
 For an end-to-end agent run, add this provider config to `mini_swe_agent_2`'s config paths — the agent config is unchanged:
 
 ```bash
-gym env start \
-    --config responses_api_agents/mini_swe_agent_2/configs/mini_swe_agent_2.yaml \
-    --config nemo_gym/sandbox/providers/ecs_fargate/configs/ecs_fargate.yaml \
-    --config <MODEL_CONFIG>
+ng_run "+config_paths=[responses_api_agents/mini_swe_agent_2/configs/mini_swe_agent_2.yaml, nemo_gym/sandbox/providers/ecs_fargate/configs/ecs_fargate.yaml, <MODEL_CONFIG>]"
 ```
 
 ## Troubleshooting

fern/versions/latest/pages/model-server/vllm.mdx

@@ -217,17 +217,17 @@ When `return_token_id_information: true`, the completions backend automatically
 The end-to-end flow is identical to the [Use VLLMModel](#use-vllmmodel) walkthrough above; just swap the model-server config:
 
 ```bash
-gym env start \
-    --config resources_servers/example_multi_step/configs/example_multi_step.yaml \
-    --config responses_api_models/vllm_model/configs/vllm_model_completions.yaml \
-    --model-url http://0.0.0.0:10240/v1 \
-    --model <your-model> \
-    --model-api-key dummy_key
+config_paths="resources_servers/example_multi_step/configs/example_multi_step.yaml,\
+responses_api_models/vllm_model/configs/vllm_model_completions.yaml"
 
-gym eval run --no-serve \
-    --agent <your_agent> \
-    --input <your_data.jsonl> \
-    --output results/rollouts_completions.jsonl
+ng_run "+config_paths=[$config_paths]" \
+    ++policy_base_url=http://0.0.0.0:10240/v1 \
+    ++policy_model_name=<your-model> \
+    ++policy_api_key=dummy_key
+
+ng_collect_rollouts +agent_name=<your_agent> \
+    +input_jsonl_fpath=<your_data.jsonl> \
+    +output_jsonl_fpath=results/rollouts_completions.jsonl
 ```
 
 Make sure your input JSONL respects the selected mode in the [Constraint matrix](#constraint-matrix) above.

resources_servers/ifbench/app.py

@@ -16,6 +16,12 @@
 import logging
 from typing import List, Literal
 
+# Pre-import packages that nltk pulls in during its init so they are already in
+# sys.modules before nltk's inisec.py finder is installed. nltk>=3.9 blocks any
+# import originating from nltk if the module path falls inside the process CWD —
+# which happens in CI where the server venv lives inside the repo root.
+import defusedxml.ElementTree  # noqa: F401
+import regex  # noqa: F401
 from fastapi import FastAPI
 
 from nemo_gym.base_resources_server import (

resources_servers/ifbench/tests/conftest.py

@@ -13,6 +13,13 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# Pre-import packages that nltk pulls in during its init so they are already in
+# sys.modules before nltk's inisec.py finder is installed. This must happen here
+# (before ensure_ifbench() calls _ensure_nltk_data() → import nltk) so that the
+# punkt download inside _ensure_nltk_data() is not silently blocked.
+import defusedxml.ElementTree  # noqa: F401
+import regex  # noqa: F401
+
 from resources_servers.ifbench.setup_ifbench import ensure_ifbench
 
 

resources_servers/iheval/app.py

@@ -82,6 +82,12 @@
 from pathlib import Path
 from typing import Any, Dict, List, Literal, Optional, Tuple
 
+# Pre-import packages that nltk pulls in during its init so they are already in
+# sys.modules before nltk's inisec.py finder is installed. nltk>=3.9 blocks any
+# import originating from nltk if the module path falls inside the process CWD —
+# which happens in CI where the server venv lives inside the repo root.
+import defusedxml.ElementTree  # noqa: F401
+import regex  # noqa: F401
 from fastapi import FastAPI
 from pydantic import ConfigDict
 

resources_servers/iheval/requirements.txt

@@ -4,4 +4,4 @@ rouge-score>=0.1.2
 # Rule-following: vendored IFEval checkers (ifeval/) depend on these.
 immutabledict>=2.0
 langdetect>=1.0.9
-nltk>=3.9
+nltk>=3.10.0

resources_servers/instruction_following/app.py

@@ -14,6 +14,12 @@
 # limitations under the License.
 from typing import Any, Dict, List
 
+# Pre-import packages that nltk pulls in during its init so they are already in
+# sys.modules before nltk's inisec.py finder is installed. nltk>=3.9 blocks any
+# import originating from nltk if the module path falls inside the process CWD —
+# which happens in CI where the server venv lives inside the repo root.
+import defusedxml.ElementTree  # noqa: F401
+import regex  # noqa: F401
 from fastapi import FastAPI
 from pydantic import model_validator
 from verifiable_instructions import instructions_registry

resources_servers/rolemrc/app.py

@@ -42,6 +42,12 @@
 from functools import lru_cache
 from typing import Any, Callable, Dict, List, Literal, Optional, Tuple
 
+# Pre-import packages that nltk pulls in during its init so they are already in
+# sys.modules before nltk's inisec.py finder is installed. nltk>=3.9 blocks any
+# import originating from nltk if the module path falls inside the process CWD —
+# which happens in CI where the server venv lives inside the repo root.
+import defusedxml.ElementTree  # noqa: F401
+import regex  # noqa: F401
 from fastapi import FastAPI
 from pydantic import ConfigDict, PrivateAttr
 

resources_servers/rolemrc/requirements.txt

@@ -2,7 +2,7 @@
 # Reference-metric scoring (reference mode).
 rouge-score>=0.1.2
 sacrebleu>=2.4
-nltk>=3.9
+nltk>=3.10.0
 # BERTScore is on by default in reference mode; pulls a roberta-large checkpoint
 # on first use. Drop these three deps (and set include_bertscore=false) for a
 # lightweight ROUGE/BLEU/METEOR-only install. matplotlib + pillow are declared

resources_servers/toolsandbox/app.py

@@ -55,7 +55,13 @@
 import uuid
 from typing import Any, Dict, List, Optional, Tuple
 
+# Pre-import packages that nltk pulls in during its init so they are already in
+# sys.modules before nltk's inisec.py finder is installed. nltk>=3.9 blocks any
+# import originating from nltk if the module path falls inside the process CWD —
+# which happens in CI where the server venv lives inside the repo root.
+import defusedxml.ElementTree  # noqa: F401
 import polars as pl
+import regex  # noqa: F401
 from fastapi import FastAPI, Request
 from openai import NOT_GIVEN
 from openai.types.chat import ChatCompletion