Added explicit pyyaml>=6.0.3 constraint to pyproject.toml to address
CVE-2017-18342 and related advisories. A codebase-wide audit confirmed
all YAML loading uses yaml.safe_load() exclusively via
cleveragents.actor.yaml_loader. Added BDD regression scenarios in
features/pyyaml_security.feature to verify the version constraint and
safe-load enforcement are maintained. Updated CHANGELOG.md with a
security entry.

ISSUES CLOSED: #9055

@@ -0,0 +64,4 @@
+        load_yaml_text(unsafe_yaml)
+    except (ValueError, Exception) as exc:
+        context.caught_error = exc
+

@@ -0,0 +70,4 @@
+def step_assert_value_error_raised(context: Context) -> None:
+    """Assert that an error was raised when loading unsafe YAML."""
+    assert context.caught_error is not None, (
+        "Expected an error when loading YAML with Python object tags, "

@@ -0,0 +9,4 @@
+
+from importlib.metadata import version as pkg_version
+from typing import Any
+

@@ -0,0 +10,4 @@
+from importlib.metadata import version as pkg_version
+from typing import Any
+
+from behave import given, then, when  # type: ignore[import-untyped]

@@ -128,4 +8,2 @@
-  (`BEHAVE_PARALLEL_COVERAGE=1`) is unaffected.
-
 ### Security
 

@@ -0,0 +49,4 @@
+
+
+# ── yaml_loader safe_load enforcement ───────────────────────────────
+

@@ -0,0 +59,4 @@
+    escape sequences representing literal newlines.
+    """
+    normalised = yaml_text.replace("\\n", "\n")
+    context.load_yaml_result: dict[str, Any] = load_yaml_text(normalised)