Add pyyaml>=6.0.2 as explicit runtime dependency in pyproject.toml to
mitigate CVE-2025-8045 (arbitrary code execution via crafted YAML
payloads). PyYAML was previously only transitive, used at runtime by
src/cleveragents/actor/yaml_loader.py for actor configuration YAML loading.

This change:

- Declares pyyaml>=6.0.2 as a direct runtime dependency with security comment
- Updates uv.lock to resolve the new explicit dependency constraint
- Adds CHANGELOG.md entry under [Unreleased] -> Security section
- Updates CONTRIBUTORS.md with HAL 9000 contribution details
- Adds BDD/Behave test (features/pyyaml_runtime_dependency.feature) verifying
  PyYAML availability and version compliance at runtime
- Adds corresponding step definitions for BDD scenarios

ISSUES CLOSED: #13605

@@ -33,4 +33,6 @@ Below are some of the specific details of various contributions.
 * HAL 9000 has contributed the LLMTraceRepository data-integrity fix (PR #8185 / issue #7505): replaced the unconditional `session.commit()` in `LLMTraceRepository.save()` with a dual-path implementation that respects the UnitOfWork pattern — flushing only when an external session is provided, and flushing + committing + closing when operating standalone. This eliminates premature transaction commits, loss of rollback capability, and a docstring/implementation mismatch.
 * HAL 9000 has contributed the ACMS Index Data Model and File Traversal Engine (PR #9664 / issue #9579): foundational data structures for indexed context entries with hot/warm/cold/archive storage tier classification, tag system, and a timeout-safe chunked file traversal engine for large projects with 10,000+ files.
 
+* HAL 9000 has contributed the PyYAML security hardening fix (PR #11012 / issue #13605): added `pyyaml>=6.0.2` as an explicit runtime dependency in `pyproject.toml` to mitigate CVE-2025-8045, replacing the previous implicit transitive-only dependency chain that left YAML config loading vulnerable to silent supply-chain breakage from upstream dependency changes.

@@ -0,0 +3,4 @@
+from __future__ import annotations
+
+import sys
+from typing import Any, Dict

@@ -0,0 +13,4 @@
+    """Attempt to import PyYAML module."""
+    context.pyyaml_import_result = "not_attempted"
+    try:
+        import yaml  # noqa: F401

@@ -0,0 +34,4 @@
+
+    version_str = getattr(yaml, "__version__", "unknown")
+    parts = version_str.split(".")[:3]
+    major, minor = int(parts[0]), int(parts[1])

@@ -0,0 +44,4 @@
+@given(
+    'a valid YAML actor config file "test.yaml" with content:',
+)
+def step_give_yaml_config_file(context, content: str) -> None:

@@ -0,0 +46,4 @@
+)
+def step_give_yaml_config_file(context, content: str) -> None:
+    """Create a temporary YAML config file for testing."""
+    import tempfile

@@ -48,6 +48,7 @@ dependencies = [
     "tenacity>=8.2.0",  # Retry framework for service layer resilience
     "aiohttp>=3.13.4",  # CVE-2026-34515 mitigation: open redirect vulnerability
     "a2a-sdk>=0.3.0,<1.0.0",  # A2A Python SDK — required transport for local (stdio) and server (HTTP) modes (ADR-047); pinned <1.0.0 (removed legacy A2AClient)
+    "pyyaml>=6.0.2",  # explicit runtime dep for YAML actor config loading; mitigates CVE-2025-8045 vulnerability in PyYAML <6.0.2

@@ -0,0 +2,4 @@
+
+from __future__ import annotations
+
+import sys

@@ -0,0 +3,4 @@
+from __future__ import annotations
+
+import sys
+from typing import Any, Dict

@@ -0,0 +10,4 @@
+
+@when("I verify that PyYAML can be imported")
+def step_verify_pyyaml_importable(context) -> None:
+    """Attempt to import PyYAML module."""

@@ -0,0 +32,4 @@
+    """Verify PyYAML version meets security floor."""
+    import yaml
+
+    version_str = getattr(yaml, "__version__", "unknown")

@@ -0,0 +48,4 @@
+    """Create a temporary YAML config file for testing."""
+    import tempfile
+    import os
+