Three occurrences of "6.0.2" on CHANGELOG.md line 192 misrepresented
the actual constraint (pyyaml>=6.0.3 in pyproject.toml). Corrected all
three to "6.0.3" to match the real security floor for CVE-2025-8045.
- Fix step definitions: remove unused imports (sys, Any, Dict), move
all imports to module level, drop noqa suppressor, fix docstring step
to use context.text, use packaging.version for correct semver check
- Upgrade version floor from 6.0.2 to 6.0.3 in step text and feature
file to match pyproject.toml constraint and issue requirement
- Fix CONTRIBUTORS.md: correct PR number (#11012 -> #11017), issue
reference (#13605 -> #11012), and version string (6.0.2 -> 6.0.3)
ISSUES CLOSED: #11012
Add pyyaml>=6.0.2 as explicit runtime dependency in pyproject.toml to
mitigate CVE-2025-8045 (arbitrary code execution via crafted YAML
payloads). PyYAML was previously only transitive, used at runtime by
src/cleveragents/actor/yaml_loader.py for actor configuration YAML loading.
This change:
- Declares pyyaml>=6.0.2 as a direct runtime dependency with security comment
- Updates uv.lock to resolve the new explicit dependency constraint (requires-dist)
- Adds CHANGELOG.md entry under [Unreleased] -> Security section
- Updates CONTRIBUTORS.md with HAL 9000 contribution details
- Adds BDD/Behave test (features/pyyaml_runtime_dependency.feature) verifying
PyYAML availability and version compliance at runtime
- Adds corresponding step definitions for BDD scenarios
ISSUES CLOSED: #13605
HAL9000
controller-ci-rerun