- Added "pyyaml>=6.0.3" as an explicit dependency constraint in pyproject.toml to proactively pin to the latest patched release and prevent resolution of vulnerable older versions.
- Updated CHANGELOG.md with a Security section entry documenting the PyYAML dependency upgrade.
- No unsafe yaml.load() calls without explicit Loader were found in the codebase.

ISSUES CLOSED: #9055

@@ -0,0 +69,4 @@
+def step_pyyaml_minimum_version(context: Context, expected: str) -> None:
+    """Assert that the PyYAML minimum version is >= expected version."""
+    min_version = context.pyyaml_min_version
+    assert min_version == expected, (

@@ -0,0 +129,4 @@
+        # Fallback for older Python versions without tomllib
+        import tomlkit
+
+        return tomlkit.parse(content.decode("utf-8")).unwrap()  # type: ignore[no-any-return]

@@ -0,0 +75,4 @@
+    )
+
+
+@when('I attempt to import the "{module_name}" module')

@@ -0,0 +69,4 @@
+def step_pyyaml_minimum_version(context: Context, expected: str) -> None:
+    """Assert that the PyYAML minimum version is >= expected version."""
+    min_version = context.pyyaml_min_version
+    assert min_version == expected, (

@@ -0,0 +129,4 @@
+        # Fallback for older Python versions without tomllib
+        import tomlkit
+
+        return tomlkit.parse(content.decode("utf-8")).unwrap()  # type: ignore[no-any-return]

@@ -0,0 +14,4 @@
+@given('the pyproject.toml file exists at "{path}"')
+def step_pyproject_exists(context: Context, path: str) -> None:
+    """Verify pyproject.toml exists at the given path."""
+    pyproject_path = Path(path)

@@ -0,0 +69,4 @@
+def step_pyyaml_minimum_version(context: Context, expected: str) -> None:
+    """Assert that the PyYAML minimum version is >= expected version."""
+    min_version = context.pyyaml_min_version
+    assert min_version == expected, (

@@ -0,0 +94,4 @@
+
+
+@then('the version constraint in uv.lock should include specifier "{specifier}"')
+def step_uv_lock_specifier(context: Context, specifier: str) -> None:

@@ -0,0 +129,4 @@
+        # Fallback for older Python versions without tomllib
+        import tomlkit
+
+        return tomlkit.parse(content.decode("utf-8")).unwrap()  # type: ignore[no-any-return]

@@ -0,0 +13,4 @@
+from packaging.version import Version
+
+
+@given('the pyproject.toml file exists at "{path}"')

@@ -0,0 +22,4 @@
+    context.pyproject_path = pyproject_path
+
+
+@when("I read the project dependencies from pyproject.toml")

@@ -0,0 +78,4 @@
+    )
+
+
+@when('I attempt to import the "{module_name}" module')

@@ -0,0 +89,4 @@
+        context.import_error = exc
+
+
+@then("the import should succeed without errors")

@@ -0,0 +13,4 @@
+from packaging.version import Version
+
+
+@given('the pyproject.toml file exists at "{path}"')

@@ -0,0 +22,4 @@
+    context.pyproject_path = pyproject_path
+
+
+@when("I read the project dependencies from pyproject.toml")

@@ -0,0 +78,4 @@
+    )
+
+
+@when('I attempt to import the "{module_name}" module')

@@ -0,0 +89,4 @@
+        context.import_error = exc
+
+
+@then("the import should succeed without errors")

@@ -0,0 +3,4 @@
+from __future__ import annotations
+
+import re
+from pathlib import Path