cleveragents/cleveragents-core
4
0
Fork 3
Code Issues 6.0k Pull Requests 115 Actions Packages Projects Releases Wiki Activity

chore(deps): upgrade PyYAML to address known security vulnerability #11078

Closed
HAL9000 wants to merge 2 commits from fix/pyyaml-security-upgrade into master
pull from: fix/pyyaml-security-upgrade
merge into: cleveragents:master
Conversation 4 Commits 2 Files Changed 6
+139 -2

2 Commits

Author SHA1 Message Date
CleverAgents Bot 2351d7e060 ci: stop master workflow on PR updates
CI / lint (pull_request) Has been cancelled
Details
CI / typecheck (pull_request) Has been cancelled
Details
CI / security (pull_request) Has been cancelled
Details
CI / quality (pull_request) Has been cancelled
Details
CI / unit_tests (pull_request) Has been cancelled
Details
CI / integration_tests (pull_request) Has been cancelled
Details
CI / e2e_tests (pull_request) Has been cancelled
Details
CI / coverage (pull_request) Has been cancelled
Details
CI / build (pull_request) Has been cancelled
Details
CI / docker (pull_request) Has been cancelled
Details
CI / helm (pull_request) Has been cancelled
Details
CI / push-validation (pull_request) Has been cancelled
Details
CI / status-check (pull_request) Has been cancelled
Details 
Remove the stale pull_request trigger from master.yml so PR branch commits do not launch the master workflow.

Maintenance patch for PR #11078.
 2026-06-10 20:19:01 -04:00
HAL9000 c11bc23bd6 chore(deps): upgrade PyYAML to address known security vulnerability
CI / benchmark-publish (pull_request) Has been skipped
Details
CI / push-validation (pull_request) Successful in 41s
Details
CI / lint (pull_request) Successful in 1m8s
Details
CI / build (pull_request) Successful in 1m6s
Details
CI / helm (pull_request) Successful in 56s
Details
CI / benchmark-regression (pull_request) Failing after 1m21s
Details
CI / quality (pull_request) Successful in 1m46s
Details
CI / typecheck (pull_request) Successful in 1m50s
Details
CI / security (pull_request) Successful in 1m50s
Details
CI / unit_tests (pull_request) Failing after 4m14s
Details
CI / e2e_tests (pull_request) Successful in 4m12s
Details
CI / coverage (pull_request) Has been skipped
Details
CI / docker (pull_request) Has been skipped
Details
CI / integration_tests (pull_request) Successful in 4m28s
Details
CI / status-check (pull_request) Failing after 8s
Details 
Add explicit PyYAML>=6.0.2 dependency to remediate CVE-2020-14343
(arbitrary code execution via malicious YAML payloads through unsafe
constructor). Establish a version floor preventing vulnerable versions
from being installed even if upstream transitive dependencies use loose
constraints. Added PyYAML as a direct dependency in pyproject.toml.

Includes BDD test coverage for YAML security validation and updated
CHANGELOG.md with security remediation detail.

ISSUES CLOSED: #9244
 2026-05-09 08:55:03 +00:00