Three step patterns in pyyaml_security_steps.py clashed with existing
step files, causing all Behave features to error at load time:
- "I call load_yaml_text with YAML text" clashed with actor_config_coverage_boost_steps.py:103
- "the load_yaml_text result should have key" clashed with actor_config_coverage_boost_steps.py:90
- "a ValueError should be raised" clashed with lsp_registry_steps.py:475
Rename all three to unique patterns and update pyyaml_security.feature
to match. Also fix typings/behave/runner.pyi ruff format (.pyi convention:
single blank line before class, no blank lines between stub methods) and
add missing fastapi>=0.100.0 to pyproject.toml (asgi_app.py imports
fastapi but it was absent from declared dependencies, causing typecheck
and integration test failures).
Refs: #9055
Remove ``# type: ignore[import-untyped]`` comments from features/steps/pyyaml_security_steps.py, replacing them with proper .pyi stubs for behave.runner.Context in typings/behave/runner.pyi.
Refs: #9055
Scenario 2 in features/pyyaml_security.feature referenced three step
definitions that were not implemented in the step file, causing
StepDefinitionNotFoundError and CI unit_tests failure:
- When I call load_yaml_text with YAML text "..."
- Then the load_yaml_text result should have key "..." equal to "..."
Added both missing step definitions with proper type annotations.
Also fixed dead code (except (ValueError, Exception) -> except Exception,
ruff B014) and toned down the alarmist assertion message per reviewer
feedback.
Added explicit pyyaml>=6.0.3 constraint to pyproject.toml to address
CVE-2017-18342 and related advisories. A codebase-wide audit confirmed
all YAML loading uses yaml.safe_load() exclusively via
cleveragents.actor.yaml_loader. Added BDD regression scenarios in
features/pyyaml_security.feature to verify the version constraint and
safe-load enforcement are maintained. Updated CHANGELOG.md with a
security entry.
ISSUES CLOSED: #9055
HAL9000