2 Commits

Author	SHA1	Message	Date
HAL9000	e6094d1fb7	fix(deps): address reviewer feedback on PyYAML security hardening ... - Fix step definitions: remove unused imports (sys, Any, Dict), move all imports to module level, drop noqa suppressor, fix docstring step to use context.text, use packaging.version for correct semver check - Upgrade version floor from 6.0.2 to 6.0.3 in step text and feature file to match pyproject.toml constraint and issue requirement - Fix CONTRIBUTORS.md: correct PR number (#11012 -> #11017), issue reference (#13605 -> #11012), and version string (6.0.2 -> 6.0.3) ISSUES CLOSED: #11012	2026-06-15 02:24:03 -04:00
HAL9000	7af8e59eb6	chore(deps): upgrade PyYAML to address known security vulnerability ... Add pyyaml>=6.0.2 as explicit runtime dependency in pyproject.toml to mitigate CVE-2025-8045 (arbitrary code execution via crafted YAML payloads). PyYAML was previously only transitive, used at runtime by src/cleveragents/actor/yaml_loader.py for actor configuration YAML loading. This change: - Declares pyyaml>=6.0.2 as a direct runtime dependency with security comment - Updates uv.lock to resolve the new explicit dependency constraint (requires-dist) - Adds CHANGELOG.md entry under [Unreleased] -> Security section - Updates CONTRIBUTORS.md with HAL 9000 contribution details - Adds BDD/Behave test (features/pyyaml_runtime_dependency.feature) verifying PyYAML availability and version compliance at runtime - Adds corresponding step definitions for BDD scenarios ISSUES CLOSED: #13605	2026-06-15 02:24:03 -04:00