HAL9000
9d861285fd
CI / security (pull_request) Failing after 17s
CI / quality (pull_request) Failing after 17s
CI / typecheck (pull_request) Failing after 19s
CI / unit_tests (pull_request) Failing after 15s
CI / lint (pull_request) Failing after 20s
CI / coverage (pull_request) Has been skipped
CI / docker (pull_request) Has been skipped
CI / benchmark-publish (pull_request) Has been skipped
CI / push-validation (pull_request) Successful in 27s
CI / helm (pull_request) Successful in 33s
CI / build (pull_request) Successful in 42s
CI / benchmark-regression (pull_request) Failing after 1m13s
CI / integration_tests (pull_request) Successful in 3m34s
CI / e2e_tests (pull_request) Successful in 4m11s
CI / status-check (pull_request) Failing after 3s
- Added `pyyaml>=6.0.3` dependency constraint to pyproject.toml after aiohttp to prevent installation of vulnerable older versions with known YAML parsing security issues. - Updated uv.lock package dependencies and requires-dist to include pyyaml entry with specifier '>=6.0.3'. - Added changelog Security section entry under [Unreleased] documenting the upgrade for issue #9055. - Updated CONTRIBUTORS.md with contribution note (PR #9244). - Added BDD test scenario verifying PyYAML security dependency constraint. ISSUES CLOSED: #9055
24 lines
1014 B
Gherkin
24 lines
1014 B
Gherkin
@tdd_issue @tdd_issue_9055
|
|
Feature: PyYAML is a declared project dependency with minimum secure version
|
|
As a CleverAgents developer
|
|
I want the PyYAML dependency to be listed in pyproject.toml with a minimum secure version
|
|
So that vulnerable older versions of PyYAML cannot be installed
|
|
|
|
Background:
|
|
Given the pyproject.toml file exists at "pyproject.toml"
|
|
|
|
@tdd_issue @tdd_issue_9055
|
|
Scenario: PyYAML is listed in project dependencies with minimum version constraint
|
|
When I read the project dependencies from pyproject.toml
|
|
Then the dependency list should include a package matching "pyyaml>="
|
|
|
|
@tdd_issue @tdd_issue_9055
|
|
Scenario: PyYAML minimum version is >=6.0.3
|
|
When I read the PyYAML dependency specification from pyproject.toml
|
|
Then the minimum version should be at least "6.0.3"
|
|
|
|
@tdd_issue @tdd_issue_9055
|
|
Scenario: yaml module is importable as a project dependency
|
|
When I attempt to import the "yaml" module
|
|
Then the import should succeed without errors
|