fix(deps): resolve open Dependabot alerts (nltk, tornado, js-yaml)

[devin-ai-integration]

Summary

Resolves all 25 open Dependabot alerts on this repo that have a patched version available.

template/requirements.txt (sandbox template image):

• nltk 3.10.0 → 3.10.3 — 21 alerts (2 critical, incl. GHSA-x99w-6fgc-pmfw, GHSA-m4rf-3fr8-xwx3), pathsec / DoS / Java-exec hardening. Supersedes chore(deps): bump nltk from 3.10.0 to 3.10.3 in /template in the pip group across 1 directory #335.
• tornado 6.5.7 → 6.5.8 — GHSA-mpf4-983q-p7j4, GHSA-8423-8fgw-73vq, GHSA-wwv5-g3v4-889x.

pnpm-lock.yaml (transitive via @changesets/*, eslint, read-yaml-file; pnpm update -r --lockfile-only js-yaml):

• js-yaml 4.3.1 → 4.3.2 and 3.15.1 → 3.15.2 — GHSA-2883-xcg3-v3hh (CPU exhaustion via empty merge sources).

Not fixable yet: GHSA-8mgp-746c-j5xp (nltk <= 3.10.3, model-artifact APIs bypass pathsec) has no patched release; alert #275 will stay open until upstream ships one.

Link to Devin session: https://app.devin.ai/sessions/a0916bebb3bb42fbac10888144103435
Open in Devin Desktop: https://app.devin.ai/desktop/session/a0916bebb3bb42fbac10888144103435?variant=devin
Requested by: @mishushakov

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[claude]

LGTM - straightforward dependency version bumps to resolve Dependabot alerts.

What was reviewed: confirmed template/requirements.txt only bumps nltk (3.10.0 to 3.10.3) and tornado (6.5.7 to 6.5.8) pins; confirmed pnpm-lock.yaml only bumps js-yaml (3.15.1 to 3.15.2, 4.3.1 to 4.3.2) with matching integrity hash updates in both packages and snapshots sections. No source code, application logic, or config behavior changes.

Extended reasoning...

Overview

This PR touches only two dependency manifest files: pnpm-lock.yaml (JS lockfile) and template/requirements.txt (Python requirements for a sandbox template image). No application source code is modified.

Security risks

The change itself is a set of upgrades to patched versions to fix known CVEs/GHSAs (js-yaml CPU exhaustion, nltk pathsec/DoS issues, tornado vulnerabilities). Verified via git diff that the lockfile changes are limited to version numbers and their corresponding sha512 integrity hashes for js-yaml 3.x and 4.x entries, and the requirements.txt changes are limited to the nltk and tornado version pins. No new dependencies were added, no scripts or install hooks changed. This is a risk-reducing change, not risk-introducing.

Level of scrutiny

This warrants low scrutiny: it is a mechanical, well-scoped dependency bump with no logic changes. The diff was reviewed directly and matches the PR description exactly.

Other factors

No CODEOWNERS/ANTOWNERS restrictions found for these paths. No CLAUDE.md conventions apply. The bug hunter found no issues, and my own review of the raw diff confirms the change is exactly what it claims to be — nothing more.