Three step patterns in pyyaml_security_steps.py clashed with existing
step files, causing all Behave features to error at load time:
- "I call load_yaml_text with YAML text" clashed with actor_config_coverage_boost_steps.py:103
- "the load_yaml_text result should have key" clashed with actor_config_coverage_boost_steps.py:90
- "a ValueError should be raised" clashed with lsp_registry_steps.py:475
Rename all three to unique patterns and update pyyaml_security.feature
to match. Also fix typings/behave/runner.pyi ruff format (.pyi convention:
single blank line before class, no blank lines between stub methods) and
add missing fastapi>=0.100.0 to pyproject.toml (asgi_app.py imports
fastapi but it was absent from declared dependencies, causing typecheck
and integration test failures).
Refs: #9055
Added explicit pyyaml>=6.0.3 constraint to pyproject.toml to address
CVE-2017-18342 and related advisories. A codebase-wide audit confirmed
all YAML loading uses yaml.safe_load() exclusively via
cleveragents.actor.yaml_loader. Added BDD regression scenarios in
features/pyyaml_security.feature to verify the version constraint and
safe-load enforcement are maintained. Updated CHANGELOG.md with a
security entry.
ISSUES CLOSED: #9055
HAL9000