chore(ci): ignore nltk PYSEC-2026-3740 in pip-audit

nltk 3.10.3 (pulled in by the rouge extra) is flagged by PYSEC-2026-3740 /
CVE-2026-81726, a path traversal in model-artifact APIs (TransitionParser,
AveragedPerceptron, PerceptronTagger, maxent). No fixed release exists yet
(nltk/nltk#3753). This repo only uses sent_tokenize and rouge_score's Porter
stemmer, so the vulnerable code is unreachable.

Ignore the advisory in CI's pip-audit and document the flag for local runs.
Removal is tracked in #520.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: arekay-nv

.github/workflows/test.yml

@@ -72,7 +72,12 @@ jobs:
         run: uv sync --frozen --extra dev --extra test --extra performance
 
       - name: Audit dependencies for known vulnerabilities
-        run: uv run pip-audit
+        # PYSEC-2026-3740 (CVE-2026-81726): nltk path traversal in model-artifact
+        # APIs (TransitionParser, AveragedPerceptron, PerceptronTagger, maxent).
+        # Unreachable here: only sent_tokenize and rouge_score's Porter stemmer
+        # are used. No fixed nltk release yet.
+        # TODO: drop the ignore - https://github.com/mlcommons/endpoints/issues/520
+        run: uv run pip-audit --ignore-vuln PYSEC-2026-3740
 
   bfcl-smoke:
     runs-on: ubuntu-latest

AGENTS.md

@@ -533,5 +533,5 @@ Known failure modes when AI tools generate code for this project. Reference thes
 
 ### Dependency & Environment
 
-- **Adding new dependencies without justification**: AI may `pip install` or add imports for packages not in `pyproject.toml`. Any new runtime, dev, or test dependency must be justified, added to the correct optional group, and pinned to an exact version (`==`). After adding a dependency, run `pip-audit` (included in `dev` extras) to verify it has no known vulnerabilities. When adding dependencies, use `uv add <package>==<version>` to update both `pyproject.toml` and `uv.lock` atomically, then run `uv run pip-audit` to check for vulnerabilities. Note: `[build-system] requires` is also pinned to exact versions for reproducibility.
+- **Adding new dependencies without justification**: AI may `pip install` or add imports for packages not in `pyproject.toml`. Any new runtime, dev, or test dependency must be justified, added to the correct optional group, and pinned to an exact version (`==`). After adding a dependency, run `pip-audit` (included in `dev` extras) to verify it has no known vulnerabilities. When adding dependencies, use `uv add <package>==<version>` to update both `pyproject.toml` and `uv.lock` atomically, then run `uv run pip-audit --ignore-vuln PYSEC-2026-3740` to check for vulnerabilities (the ignored `nltk` advisory has no fixed release and its affected APIs are unused; tracked in https://github.com/mlcommons/endpoints/issues/520). Note: `[build-system] requires` is also pinned to exact versions for reproducibility.
 - **Using `requests`/`aiohttp` for HTTP**: This project has its own HTTP client (`endpoint_client/http.py`) using `httptools`. AI defaults to `requests` or `aiohttp` — these should not appear in production code (test dependencies are fine).

docs/DEVELOPMENT.md

@@ -226,9 +226,11 @@ Use `uv add <package>==<version>` to update both `pyproject.toml` and `uv.lock`
 After adding a dependency, run `pip-audit` to verify it has no known vulnerabilities:
 
 ```bash
-uv run pip-audit
+uv run pip-audit --ignore-vuln PYSEC-2026-3740
 ```
 
+`PYSEC-2026-3740` is an `nltk` advisory with no fixed release whose affected APIs this repo doesn't use; CI ignores it too. Drop the flag once [#520](https://github.com/mlcommons/endpoints/issues/520) is resolved.
+
 ## Performance Considerations
 
 Code in `load_generator/`, `endpoint_client/worker.py`, and `async_utils/transport/` is latency-critical. In these paths:

pyproject.toml

@@ -170,6 +170,9 @@ rouge = [
     # NOTE: not self-contained at runtime - nltk needs the punkt/punkt_tab
     # corpora and evaluate.load("rouge") fetches its metric script from the HF
     # Hub, so an offline image must prefetch both.
+    # nltk advisory PYSEC-2026-3740 has no fixed release and is ignored in CI's
+    # pip-audit (affected APIs unused); tracked in
+    # https://github.com/mlcommons/endpoints/issues/520
     "nltk==3.10.3",
     "evaluate==0.4.6",
     "rouge-score==0.1.2",