security(deps): the dependency audit gate is red on Dev_new_gui — PYSEC-2026-3740 against nltk has no recorded allowance #15520

Problem

The Dependency Security Scan gate is red on Dev_new_gui itself, not only on PRs. Observed on base head 0937e1504:

Found 5 known vulnerabilities in 2 packages
**FAIL** — 1 unallowed finding(s) at any severity, with 4 recorded allowance(s).
Recorded allowances: CVE-2026-45830, CVE-2026-45831, CVE-2026-45833, PYSEC-2026-311
Findings judged by this gate (first 10):
- PYSEC-2026-3740 [unknown] nltk==3.10.3

Four of the five findings carry recorded allowances. The fifth, PYSEC-2026-3740 against nltk==3.10.3, does not, so the gate fails as designed.

Where it comes from

• requirements-ci/document.txt:6 — nltk==3.10.3 (the pinned version the audit installs)
• autobot-infrastructure/shared/docker/ai-stack/requirements-ai.txt:37 — nltk>=3.10.3 (floor; resolves to the same or newer)

Why this needs its own issue rather than a per-PR note

Because base is red, every open PR inherits the failure. It was found while diagnosing PR #15517, which was suspected of introducing it by declaring new dependencies — it did not. Confirming that took a comparison against the base run, and the next person to hit it will spend the same time unless the cause is written down. A red that predates the branch is indistinguishable, on the PR page, from one the branch caused.

The gate is also working exactly as intended here, which is worth stating plainly: it refuses to pass an unallowed finding, and its own error text says "Fix the finding; do not re-add" an override. So the correct resolution is a version bump or a recorded allowance with a justification — not loosening the gate.

Acceptance criteria

• Establish what PYSEC-2026-3740 actually is — affected versions, fixed version, and whether the vulnerable code path is reachable from how this repository uses nltk. Severity is reported as unknown, so the gate cannot rank it; a human judgement is required and should be recorded on this issue.
• Bump nltk past the fixed version in both requirements-ci/document.txt and autobot-infrastructure/shared/docker/ai-stack/requirements-ai.txt, keeping the two consistent — a pin and a floor that disagree is how this class of drift starts.
• If no fixed version exists yet, record an allowance with the reason and a re-check date, in the same place the four existing allowances live. An allowance without a stated justification is not acceptable — that is the pattern bug(ci): .github/codeql/python-exclusions.qls is referenced by nothing — every exclusion in it is a no-op #15486 exists to stop.
• Confirm the gate returns green on Dev_new_gui afterwards, and note the run.
• Check whether the four existing allowances (CVE-2026-45830, CVE-2026-45831, CVE-2026-45833, PYSEC-2026-311) still apply, or have been fixed upstream and can be removed. An allowance list that only grows is the same shape as a ratchet that only grows.

Related

#12262 (umbrella: reconcile open security alerts with tracking issues) — this is one of them, previously untracked.