Skip to content

fix: register nltk download path before downloading cmudict - #566

Merged
NeonDaniel merged 1 commit into
NeonGeckoCom:devfrom
mikejgray:FIX_NltkDownloadPathAuthorization
Aug 7, 2026
Merged

NeonDaniel merged 1 commit into
NeonGeckoCom:devfrom
mikejgray:FIX_NltkDownloadPathAuthorization

Conversation

@mikejgray

@mikejgray mikejgray commented Aug 7, 2026 •

Copy link
Copy Markdown
Contributor

Summary

The unit_tests workflow fails on dev at the Test Parse Utils step, on Python 3.10, 3.11, and 3.12. The failed test is tests/parse_util_tests.py::ParseUtilTests::test_get_phonemes.

The cause is a change in nltk 3.10, not a change in this repository. nltk added nltk/pathsec.py, which authorizes a download target against the directories in nltk.data.path. get_phonemes (neon_utils/parse_utils.py:115) registered its download directory one line after the download call:

nltk.download('cmudict', download_dir=download_path)
nltk.data.path.append(download_path)

The download ran against a path that was not yet registered, so nltk refused it:

[nltk_data] Error downloading 'cmudict' ... Security Violation
[nltk_data] [Downloader._download_package]: Unauthorized path
[nltk_data] /home/runner/.local/share/neon/corpora/cmudict.zip.tmp

cmudict did not install. The corpus lookup then raised LookupError.

requirements/requirements.txt pins nltk~=3.5, which permits 3.10.2. The last dev run that passed was 2026-06-08, before this nltk release.

Change

Register the download path before the download. The in test prevents duplicate entries in nltk.data.path on repeat calls.

Test plan

  • Reproduced the fault alone: nltk.download('cmudict', download_dir=...) returns False with the security violation above when the directory is absent from nltk.data.path. It returns True when the directory is present.
  • Deleted the local corpus cache to get the same cold-cache state as CI. test_get_phonemes fails before this change and passes after it.
  • tests/parse_util_tests.py: 15 passed from a cold cache.

Note

This change is independent of #565. #565 starts from the same commit and shows the same CI fault, which this change corrects.

🤖 Generated with Claude Code

nltk 3.10 authorizes download targets against `nltk.data.path`
(`nltk/pathsec.py`). `get_phonemes` appended its custom download
directory after calling `nltk.download`, so the download was rejected
with "Security Violation: Unauthorized path" and `cmudict` never
installed.

Register the path first. Verified against a cold cache: the existing
`test_get_phonemes` fails before this change and passes after.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@NeonDaniel
NeonDaniel merged commit 2377507 into NeonGeckoCom:dev Aug 7, 2026
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants