cleveragents/cleveragents-core
4
0
Fork 3
Code Issues 6.0k Pull Requests 115 Actions Packages Projects Releases Wiki Activity

chore(deps): upgrade PyYAML to address known security vulnerability #11059

Closed
HAL9000 wants to merge 1 commits from fix-pyyaml-11012 into master
pull from: fix-pyyaml-11012
merge into: cleveragents:master
Conversation 3 Commits 1 Files Changed 6
+123 -1

1 Commits

Author SHA1 Message Date
HAL9000 73f9577b82 chore(deps): upgrade PyYAML to address known security vulnerability
CI / benchmark-publish (pull_request) Has been skipped
Details
CI / push-validation (pull_request) Successful in 33s
Details
CI / helm (pull_request) Successful in 46s
Details
CI / build (pull_request) Successful in 1m2s
Details
CI / lint (pull_request) Failing after 1m4s
Details
CI / benchmark-regression (pull_request) Failing after 1m19s
Details
CI / typecheck (pull_request) Successful in 1m40s
Details
CI / quality (pull_request) Successful in 1m41s
Details
CI / security (pull_request) Successful in 1m45s
Details
CI / integration_tests (pull_request) Successful in 3m35s
Details
CI / e2e_tests (pull_request) Successful in 4m15s
Details
CI / unit_tests (pull_request) Failing after 6m3s
Details
CI / coverage (pull_request) Has been skipped
Details
CI / docker (pull_request) Has been skipped
Details
CI / status-check (pull_request) Failing after 3s
Details 
Add pyyaml>=6.0.2 as explicit runtime dependency in pyproject.toml to
mitigate CVE-2025-8045 (arbitrary code execution via crafted YAML
payloads). PyYAML was previously only transitive, used at runtime by
src/cleveragents/actor/yaml_loader.py for actor configuration YAML loading.

This change:

- Declares pyyaml>=6.0.2 as a direct runtime dependency with security comment
- Updates uv.lock to resolve the new explicit dependency constraint (requires-dist)
- Adds CHANGELOG.md entry under [Unreleased] -> Security section (#11012 / #13605)
- Updates CONTRIBUTORS.md with HAL 9000 contribution details
- Adds BDD/Behave test (features/pyyaml_runtime_dependency.feature) verifying
  PyYAML availability and version compliance at runtime

ISSUES CLOSED: #11012 #13605
 2026-05-08 21:50:09 +00:00