cp: security: bump nltk >=3.10.0 and fix inisec import blocks (2290) into r0.5.0

resources_servers/ifbench/app.py

@@ -16,6 +16,12 @@
 import logging
 from typing import List, Literal
 
+# Pre-import packages that nltk pulls in during its init so they are already in
+# sys.modules before nltk's inisec.py finder is installed. nltk>=3.9 blocks any
+# import originating from nltk if the module path falls inside the process CWD —
+# which happens in CI where the server venv lives inside the repo root.
+import defusedxml.ElementTree  # noqa: F401
+import regex  # noqa: F401
 from fastapi import FastAPI
 
 from nemo_gym.base_resources_server import (

resources_servers/ifbench/tests/conftest.py

@@ -13,6 +13,13 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# Pre-import packages that nltk pulls in during its init so they are already in
+# sys.modules before nltk's inisec.py finder is installed. This must happen here
+# (before ensure_ifbench() calls _ensure_nltk_data() → import nltk) so that the
+# punkt download inside _ensure_nltk_data() is not silently blocked.
+import defusedxml.ElementTree  # noqa: F401
+import regex  # noqa: F401
+
 from resources_servers.ifbench.setup_ifbench import ensure_ifbench
 
 

resources_servers/iheval/app.py

@@ -82,6 +82,12 @@
 from pathlib import Path
 from typing import Any, Dict, List, Literal, Optional, Tuple
 
+# Pre-import packages that nltk pulls in during its init so they are already in
+# sys.modules before nltk's inisec.py finder is installed. nltk>=3.9 blocks any
+# import originating from nltk if the module path falls inside the process CWD —
+# which happens in CI where the server venv lives inside the repo root.
+import defusedxml.ElementTree  # noqa: F401
+import regex  # noqa: F401
 from fastapi import FastAPI
 from pydantic import ConfigDict
 

resources_servers/iheval/requirements.txt

@@ -4,4 +4,4 @@ rouge-score>=0.1.2
 # Rule-following: vendored IFEval checkers (ifeval/) depend on these.
 immutabledict>=2.0
 langdetect>=1.0.9
-nltk>=3.9
+nltk>=3.10.0

resources_servers/instruction_following/app.py

@@ -14,6 +14,12 @@
 # limitations under the License.
 from typing import Any, Dict, List
 
+# Pre-import packages that nltk pulls in during its init so they are already in
+# sys.modules before nltk's inisec.py finder is installed. nltk>=3.9 blocks any
+# import originating from nltk if the module path falls inside the process CWD —
+# which happens in CI where the server venv lives inside the repo root.
+import defusedxml.ElementTree  # noqa: F401
+import regex  # noqa: F401
 from fastapi import FastAPI
 from pydantic import model_validator
 from verifiable_instructions import instructions_registry

resources_servers/rolemrc/app.py

@@ -42,6 +42,12 @@
 from functools import lru_cache
 from typing import Any, Callable, Dict, List, Literal, Optional, Tuple
 
+# Pre-import packages that nltk pulls in during its init so they are already in
+# sys.modules before nltk's inisec.py finder is installed. nltk>=3.9 blocks any
+# import originating from nltk if the module path falls inside the process CWD —
+# which happens in CI where the server venv lives inside the repo root.
+import defusedxml.ElementTree  # noqa: F401
+import regex  # noqa: F401
 from fastapi import FastAPI
 from pydantic import ConfigDict, PrivateAttr
 

resources_servers/rolemrc/requirements.txt

@@ -2,7 +2,7 @@
 # Reference-metric scoring (reference mode).
 rouge-score>=0.1.2
 sacrebleu>=2.4
-nltk>=3.9
+nltk>=3.10.0
 # BERTScore is on by default in reference mode; pulls a roberta-large checkpoint
 # on first use. Drop these three deps (and set include_bertscore=false) for a
 # lightweight ROUGE/BLEU/METEOR-only install. matplotlib + pillow are declared

resources_servers/toolsandbox/app.py

@@ -55,7 +55,13 @@
 import uuid
 from typing import Any, Dict, List, Optional, Tuple
 
+# Pre-import packages that nltk pulls in during its init so they are already in
+# sys.modules before nltk's inisec.py finder is installed. nltk>=3.9 blocks any
+# import originating from nltk if the module path falls inside the process CWD —
+# which happens in CI where the server venv lives inside the repo root.
+import defusedxml.ElementTree  # noqa: F401
 import polars as pl
+import regex  # noqa: F401
 from fastapi import FastAPI, Request
 from openai import NOT_GIVEN
 from openai.types.chat import ChatCompletion