Bump actions/checkout from 4 to 6

.github/workflows/code_checks.yml

@@ -29,7 +29,7 @@ jobs:
   run-code-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v6
 
       - name: Install uv
         uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b

.github/workflows/docker-publish.yml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up QEMU (for multi-arch)
         uses: docker/setup-qemu-action@v3

.github/workflows/docs.yml

@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v6
 
       - name: Install uv
         uses: astral-sh/setup-uv@v7.2.0
@@ -77,7 +77,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v6
 
       - name: Configure Git Credentials
         run: |

.github/workflows/publish.yml

@@ -16,7 +16,7 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install libcurl4-openssl-dev libssl-dev
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v6
 
       - name: Install uv
         uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b

.github/workflows/unit_tests.yml

@@ -39,7 +39,7 @@ jobs:
   unit-tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v6
 
       - name: Install uv
         uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b

pyproject.toml

@@ -10,7 +10,10 @@ requires-python = ">=3.11"
 dependencies = [
     "filelock>=3.20.3", # Pinning version to address vulnerabilities CVE-2025-68146, CVE-2026-22701
     "fonttools>=4.60.2", # Pinning version to address vulnerability GHSA-768j-98cg-p3fv
-    "werkzeug>=3.1.5", # Pinning version to address vulnerabilities GHSA-hgf8-39gv-g3f2, CVE-2026-21860
+    "pillow>=12.1.1", # Pinning version to address vulnerability CVE-2026-25990
+    "pygments>=2.20.0", # Pinning version to address vulnerability CVE-2026-4539
+    "tornado>=6.5.5", # Pinning version to address vulnerabilities GHSA-78cv-mqj4-43f7, CVE-2026-31958
+    "werkzeug>=3.1.6", # Pinning version to address vulnerabilities GHSA-hgf8-39gv-g3f2, CVE-2026-21860, CVE-2026-27199
     "virtualenv>=20.36.1", # TODO: Update to >=20.36.2 when released to address CVE-2026-22702
     "absl-py>=2.3.1",
     "python-dotenv>=1.0.0",
@@ -19,7 +22,7 @@ dependencies = [
     "huggingface-hub>=0.33.2",
     "matplotlib>=3.7.5",
     "natsort>=8.4.0",
-    "nltk>=3.9.1",
+    "nltk>=3.9.4", # Pinning version to address vulnerability GHSA-rf74-v2fm-23pw
     "numpy>=1.24.4,<2.0.0",
     "openai>=1.93.0",
     "pytest>=8.4.2",
@@ -31,7 +34,7 @@ dependencies = [
     "pydantic>=2.10.6",
     "pyyaml>=6.0.2",
     "rapidfuzz>=3.9.7",
-    "requests>=2.32.4",
+    "requests>=2.33.0", # Pinning version to address vulnerability CVE-2026-25645
     "rich>=13.9.4",
     "scikit-learn>=1.5.0",
     "scipy>=1.10.1",
@@ -61,7 +64,7 @@ dev = [
     "codecov>=2.1.13",
     "mypy>=1.14.1",
     "nbqa>=1.9.1",
-    "pip>=25.3", # Pinning version to address vulnerability GHSA-4xh5-x5gv-qwph
+    "pip>=26.0", # Pinning version to address vulnerabilities GHSA-4xh5-x5gv-qwph, CVE-2026-1703
     "pip-audit>=2.7.3",
     "pre-commit>=4.1.0",
     "pytest>=8.3.4",

src/utils/json_io.py

@@ -58,7 +58,7 @@ def write_json_raw(path: str, data: list[dict]) -> None:
         The data to write as JSON.
     """
     with open(path, "w") as f:
-        f.write(json.dumps(data, indent=4))
+        f.write(json.dumps(data, indent=4) + "\n")
 
 
 def write_json(path: str, data: list[T]) -> None:
@@ -74,4 +74,4 @@ def write_json(path: str, data: list[T]) -> None:
     """
     out_data = [item.model_dump() for item in data]
     with open(path, "w") as f:
-        f.write(json.dumps(out_data, indent=4))
+        f.write(json.dumps(out_data, indent=4) + "\n")

test.json

@@ -3,4 +3,4 @@
         "idx": "i1",
         "a": 1
     }
-]
+]