fix(deps): correct pyyaml version floor in CHANGELOG from 6.0.2 to 6.0.3

Three occurrences of "6.0.2" on CHANGELOG.md line 192 misrepresented the actual constraint (pyyaml>=6.0.3 in pyproject.toml). Corrected all three to "6.0.3" to match the real security floor for CVE-2025-8045.
2026-06-15 01:06:38 -04:00
parent e6094d1fb7
commit a0b63a5ec4
1 changed files with 1 additions and 1 deletions
@@ -189,7 +189,7 @@ ensuring data is stored with proper parameter values.
 - **A2A module rename BDD test suite** (#8615): Comprehensive Behave tests validating that the ACP→A2A module rename is complete — verifying all 22 A2A symbols are properly exported, no legacy ACP references remain in `.py` files under `cleveragents.a2a/`, and the module docstring uses current A2A naming. The step definitions include self-contained symbol lookups to avoid cross-scenario dependency failures.

 ### Security
- **PyYAML declared as explicit runtime dependency** (#11012 / #13605): Added `pyyaml>=6.0.2` as a direct runtime dependency in `pyproject.toml`. PyYAML was previously only transitive (pulled via langchain ecosystem), listed solely as type stubs (`types-pyyaml>=6.0.0`) in the dev extras group, while being used at runtime in `src/cleveragents/actor/yaml_loader.py` for actor configuration YAML loading with Jinja2 template support and environment variable interpolation. This change explicitly pins the dependency to `>=6.0.2` to mitigate CVE-2025-8045 (arbitrary remote code execution via crafted YAML payloads) and prevents silent breakage if upstream transitive dependencies change their PyYAML requirements in future releases. The version floor ensures vulnerable versions (<6.0.2) cannot be installed even if upstream transitive dependencies have loose version constraints.
+- **PyYAML declared as explicit runtime dependency** (#11012 / #13605): Added `pyyaml>=6.0.3` as a direct runtime dependency in `pyproject.toml`. PyYAML was previously only transitive (pulled via langchain ecosystem), listed solely as type stubs (`types-pyyaml>=6.0.0`) in the dev extras group, while being used at runtime in `src/cleveragents/actor/yaml_loader.py` for actor configuration YAML loading with Jinja2 template support and environment variable interpolation. This change explicitly pins the dependency to `>=6.0.3` to mitigate CVE-2025-8045 (arbitrary remote code execution via crafted YAML payloads) and prevents silent breakage if upstream transitive dependencies change their PyYAML requirements in future releases. The version floor ensures vulnerable versions (<6.0.3) cannot be installed even if upstream transitive dependencies have loose version constraints.

 - Fixed `ReactiveEventBus.emit()` exception handler to log the full exception
  message (`str(exc)`) and enable traceback forwarding (`exc_info=True`).