Duplicate step definitions for 'the pyproject.toml file exists at',
'I read the project dependencies from pyproject.toml',
'I attempt to import the module', and 'the import should succeed without
errors' were present in both security_pyyaml_dependency_steps.py and
tdd_a2a_sdk_dependency_steps.py, causing a behave.AmbiguousStep error
that failed the unit_tests CI gate.
Removed the 4 duplicate step definitions from security_pyyaml_dependency_steps.py,
keeping only the 3 PyYAML-specific step definitions. The shared steps are
now exclusively provided by tdd_a2a_sdk_dependency_steps.py.
Also resolved merge conflicts from master in CONTRIBUTORS.md: preserved
all master additions (database resource types entry) alongside the existing
PyYAML upgrade entry.
ISSUES CLOSED: #9055
- Move _flatten_toml_dict to module level: eliminates nested function
definition that ruff format reformats unexpectedly; makes the helper
independently testable and clearly documented.
- Rename helper to _flatten_toml_dict (was _flatten) for unambiguous
module-level identity and improved readability.
- Add _PROJECT_ROOT constant computed from __file__ so pyproject.toml
is always resolved via an absolute path regardless of the process
working directory — fixes brittle relative-path lookup that fails
when behave-parallel forks workers whose cwd differs from the repo root.
- Fix ruff format violations: wrap long assert message, normalise
decorator quote style, ensure trailing newline, fix import ordering
(behave imports before packaging).
- All quality gates pass: lint, format --check, security_scan, dead_code.
ISSUES CLOSED: #9055
- Added `pyyaml>=6.0.3` dependency constraint to pyproject.toml after
aiohttp to prevent installation of vulnerable older versions with known
YAML parsing security issues.
- Updated uv.lock package dependencies and requires-dist to include pyyaml
entry with specifier '>=6.0.3'.
- Added changelog Security section entry under [Unreleased] documenting the
upgrade for issue #9055.
- Updated CONTRIBUTORS.md with contribution note (PR #9244).
- Added BDD test scenario verifying PyYAML security dependency constraint.
ISSUES CLOSED: #9055
HAL9000