HAL9000
05acc26c40
- Added `pyyaml>=6.0.3` dependency constraint to pyproject.toml after aiohttp to prevent installation of vulnerable older versions with known YAML parsing security issues. - Updated uv.lock package dependencies and requires-dist to include pyyaml entry with specifier '>=6.0.3'. - Added changelog Security section entry under [Unreleased] documenting the upgrade for issue #9055. - Updated CONTRIBUTORS.md with contribution note (PR #9244). - Added BDD test scenario verifying PyYAML security dependency constraint. ISSUES CLOSED: #9055
24 lines
1014 B
Gherkin
24 lines
1014 B
Gherkin
@tdd_issue @tdd_issue_9055
|
|
Feature: PyYAML is a declared project dependency with minimum secure version
|
|
As a CleverAgents developer
|
|
I want the PyYAML dependency to be listed in pyproject.toml with a minimum secure version
|
|
So that vulnerable older versions of PyYAML cannot be installed
|
|
|
|
Background:
|
|
Given the pyproject.toml file exists at "pyproject.toml"
|
|
|
|
@tdd_issue @tdd_issue_9055
|
|
Scenario: PyYAML is listed in project dependencies with minimum version constraint
|
|
When I read the project dependencies from pyproject.toml
|
|
Then the dependency list should include a package matching "pyyaml>="
|
|
|
|
@tdd_issue @tdd_issue_9055
|
|
Scenario: PyYAML minimum version is >=6.0.3
|
|
When I read the PyYAML dependency specification from pyproject.toml
|
|
Then the minimum version should be at least "6.0.3"
|
|
|
|
@tdd_issue @tdd_issue_9055
|
|
Scenario: yaml module is importable as a project dependency
|
|
When I attempt to import the "yaml" module
|
|
Then the import should succeed without errors
|