chore(deps): bump the uv group across 1 directory with 2 updates

[dependabot]

Bumps the uv group with 2 updates in the /components/aggregator directory: json-repair and nltk.

Updates json-repair from 0.58.0 to 0.60.1

Release notes

Sourced from json-repair's releases.

Release 0.60.1

Added

• A potential infinite loop in schema resolution could cause an application using the library to crash if the schema was self referential

Support this project

json_repair is maintained as a side project and stays free for everyone.

If it saves you debugging time, helps you handle LLM-generated JSON, or is part of your production workflow, please consider:

• starring the repository to help more developers find it
• sharing it with teams working with unreliable JSON output
• sponsoring the project here: https://github.com/sponsors/mangiucugna

Sponsorship helps justify the time spent fixing edge cases, improving performance, and keeping the library reliable.

Release 0.60.0

Added

• Support for repairing string values that contain low smart quote spans like „... when the closing quote is emitted as ASCII " instead of Unicode ”. Issue #198

Support this project

json_repair is maintained as a side project and stays free for everyone.

If it saves you debugging time, helps you handle LLM-generated JSON, or is part of your production workflow, please consider:

• starring the repository to help more developers find it
• sharing it with teams working with unreliable JSON output
• sponsoring the project here: https://github.com/sponsors/mangiucugna

Sponsorship helps justify the time spent fixing edge cases, improving performance, and keeping the library reliable.

Release 0.59.10

Fixed

• Fixed a parser-path repair bug where balanced brace groups inside string values, such as LaTeX fragments like \frac{x^2}{m}, could be mistaken for object structure when a later inline JSON-like snippet appeared in the same string.
• Improved preservation of malformed-but-string-intended explanations containing inline literals such as {"blank_1": "5"} without splitting the surrounding object.

Support this project

json_repair is maintained as a side project and stays free for everyone.

If it saves you debugging time, helps you handle LLM-generated JSON, or is part of your production workflow, please consider:

• starring the repository to help more developers find it
• sharing it with teams working with unreliable JSON output
• sponsoring the project here: https://github.com/sponsors/mangiucugna

Sponsorship helps justify the time spent fixing edge cases, improving performance, and keeping the library reliable.

Release 0.59.9

Fixed

-Fix #196, a regression introduced to fix #170 caused issue with top-level object duplication.

... (truncated)

Commits

• 63992e9 Fix circular schema ref handling
• 7cd8391 Fix #198 support low smart quote spans in strings
• 46be950 update ANGENTS guidance
• 0015c74 Fix README example for #197
• d7f2a3b Fix #195 keep balanced braces in strings
• 4206302 Fix top-level comma-separated object repair
• 9c9db65 Fix #195 preserve LaTeX escapes after prose commas
• dbec25a Bump version to 0.59.7
• 397fbe0 Fix #195 preserve escaped brace groups
• b8cd2e2 Fix #194 line comments with brackets
• Additional commits viewable in compare view

Updates nltk from 3.9.4 to 3.10.0

Release notes

Sourced from nltk's releases.

v3.10.0-rc1

What's Changed

• CHILDES corpus reader: lazy loading (fixes #1340) by @​nschneid in nltk/nltk#1341
• Stanseg by @​casperlehmann in nltk/nltk#1350
• Add optional CCG semantics computation by @​tanin47 in nltk/nltk#1321
• address of free software foundation updated by @​Lightyagami1 in nltk/nltk#1347
• Added a verification for empty tokens by @​gnardari in nltk/nltk#1353
• use data.load for vader lexicon by @​afgiel in nltk/nltk#1303
• Ensure that proper exceptions are caught correctly by @​pombredanne in nltk/nltk#1343
• Reset CCGVar everytime we invoke lexicon.fromstring() and skip the unicode test because it fails on python2.7 by @​tanin47 in nltk/nltk#1354
• Add tanin as an author :) by @​tanin47 in nltk/nltk#1355
• framenet.py: remove unnecessary str() call that causes problems for names with Unicode characters by @​nschneid in nltk/nltk#1360
• remove u because it doesn't work in Python 3.0 to 3.2 by @​tanin47 in nltk/nltk#1362
• moved the import for dispersion_plot out of the else block by @​dennisobrien in nltk/nltk#1364
• Raise warning for infinite recursion by @​alvations in nltk/nltk#1365
• Patch None TypeError in align_blocks() by @​alvations in nltk/nltk#1366
• Safer try-except for catching infinite recursion by @​alvations in nltk/nltk#1368
• Collections refactor by @​nschneid in nltk/nltk#1382
• Handles fringe cases in BLEU by @​alvations in nltk/nltk#1383
• Allow specifying substitution cost in edit distance by @​dnc1994 in nltk/nltk#1386
• Pl196x fixes by @​pkasprzyk in nltk/nltk#1359
• Docs/ngrams by @​ColCarroll in nltk/nltk#1403
• Fix conll.py by @​germanferrero in nltk/nltk#1402
• Aline by @​geoffbacon in nltk/nltk#1407
• Handle empty files in a corpus by @​alexisdimi in nltk/nltk#1411
• fixed bug: StackDecoder would throw exception if it's unable to finish… by @​hikui in nltk/nltk#1405
• add hikui to authors by @​hikui in nltk/nltk#1412
• removes download-cache pip flag from tox config by @​fievelk in nltk/nltk#1415
• Added three tokenizers, one detokenizer and two tokenizer-related word/char list corpora by @​alvations in nltk/nltk#1282
• Much faster Vader sentiment tagging by @​georgeberry in nltk/nltk#1409
• Fixes doctest in is_cjk() and REPP tokenizer wrapper by @​alvations in nltk/nltk#1420
• Fixed doctest for UnicharsCorpusReader and NonbreakingPrefixesCorpusReader by @​alvations in nltk/nltk#1422
• Updated senna version in docstring by @​alvations in nltk/nltk#1431
• Removes Python 2.6 and Python 3.1-3.3 code, Improves Python 3.5 syntax by @​adamn in nltk/nltk#1429
• Cleanup by @​dimazest in nltk/nltk#1432
• Fix zero division & log(0) in PunktTrainer._col_log_likelihood by @​mrecachinas in nltk/nltk#1247
• Update stanford_segmenter.py by @​janissl in nltk/nltk#1444
• explained data format for constructor by @​drevicko in nltk/nltk#1450
• Use a more efficient idiom for flattening nested lists by @​rmalouf in nltk/nltk#1447
• improved documentation of load_array() by @​drevicko in nltk/nltk#1452
• changed "list or iterator" to "sequence" by @​drevicko in nltk/nltk#1453
• Deal gracefully with degenerate cases. by @​drevicko in nltk/nltk#1454
• deal with (hopefully) all degenerate cases by @​drevicko in nltk/nltk#1455
• Enable unordered comparison for gaac clustering by @​alvations in nltk/nltk#1456
• Rewrite porter.py by @​ExplodingCabbage in nltk/nltk#1261
• Update naivebayes.py by @​andyreagan in nltk/nltk#1461
• Fixes bug where download status not returned. by @​nsfabina in nltk/nltk#1468
• Use lcon and rcon variables in conllned() when trace is False - Issue #1474 by @​timleslie in nltk/nltk#1475
• Use shutil.copyfileobj for unzipping by @​ikorolev93 in nltk/nltk#1478
• Fixing Chen&Cherry method 6 smoothing in BLEU score by @​alvations in nltk/nltk#1477

... (truncated)

Changelog

Sourced from nltk's changelog.

Version 3.10.0 2026-06-11

• Enforce the stricter nltk.pathsec security policy by default
• Document the new security model and migration guidance
• Harden resource loading against path traversal and SSRF/DNS-rebinding
• Harden downloader path handling and block XML entity expansion
• Close remaining corpus-reader security edge cases
• Replace unsafe exec() usage in the utility CLI
• Warn on unpickling user-provided pickles
• Add HuggingFace datasets integration (nltk.huggingface)
• Align TnT with Brants (2000) specifications
• Fix PorterStemmer irregular-form lowercasing in NLTK mode
• Fix TransitionParser sparse index dtype for scikit-learn 1.9
• Fix TextCat tie handling
• Fix WordNet object comparisons for incompatible types
• Cache WordNet max depth lazily for lch_similarity()
• Fix CCG variable direction, substitution, and type-raising bugs
• Fix Jaro similarity for single-character and empty-string cases
• Improve CI and release-maintenance workflows

Thanks to the following contributors to 3.10.0: 13rac1, alvations, bowiechen, devesh-2002, ekaf, elias-ba, haosenwang1018, HyperPS, ihitamandal, jancallewaert, jhnwnstd, JuanIMartinezB, Lemm1, LinZiyuu, Mr-Neutr0n, PastelStorm, scruge1, Syzygy2048, ylwango613, yzhaoinuw

Version 3.9.4 2026-03-24

• Support Python 3.14
• Fix bug in Levenshtein distance when substitution_cost > 2
• Fix bug in Treebank detokeniser re quote ordering
• Fix bug in Jaro similarity for empty strings
• Several security enhancements
• Fix GHSA-rf74-v2fm-23pw: unbounded recursion in JSONTaggedDecoder
• Implement TextTiling vocabulary introduction method (Hearst 1997)
• Fix ALINE feature matrix errors and add comprehensive tests
• Support multiple VerbNet versions, fix longid/shortid regex for VerbNet ids
• Let downloader fallback to md5 when sha256 is unavailable
• Several other minor bugfixes and code cleanups

Thanks to the following contributors to 3.9.4: Min-Yen Kan, Eric Kafe, Emily Voss, bowiechen, Hrudhai01, jancallewaert, Mr-Neutr0n, pollak.peter89, ylwango613,

Version 3.9.3 2026-02-21

• Fix CVE-2025-14009: secure ZIP extraction in nltk.downloader (#3468)
• Block path traversal/arbitrary reads in nltk.data for protocol-less refs (#3467)
• Block path traversal/abs paths in corpus readers and FS pointers (#3479, #3480)
• Validate external StanfordSegmenter JARs using SHA256 (#3477)

... (truncated)

Commits

• bd49f90 allow escaped brackets in Tree.fromstring (#3694)
• 27b8ad6 don't crash chomsky_normal_form on terminals with siblings (#3693)
• 52227d2 Use os.name for Windows path handling (#3605)
• 06c0e2c Avoid RIBES zero division on empty inputs (#3604)
• a167389 Treat missing unzip output as stale (#3607)
• c94c967 Fix EOF empty document bug in IEER corpus reader (#3648)
• 94a259c Enforce restrictive primitive type checking in pathsec wrappers (#3692)
• 5ac475d fix(security): isolate Stanford Java options and clean temp files (#3683)
• 986f26e ci(deps): bump the github-actions group with 3 updates (#3691)
• f26b375 fix(security): prevent pickle RCE in TransitionParser model loading (CWE-502)...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.