Replaced YAML.load_file with YAML.safe_load_file to prevent potential arbitrary code execution when loading configuration files

[yamotech]

This pull request improves the security of configuration file loading by replacing the potentially unsafe YAML.load_file with YAML.safe_load_file. This change helps prevent arbitrary code execution vulnerabilities when parsing YAML files.

Security improvements:

• Replaced YAML.load_file with YAML.safe_load_file in the parse_yaml method in lib/active_record/dbt/configuration/parser.rb to ensure safer loading of YAML configuration files.
• Updated the CHANGELOG.md to document the replacement of YAML.load_file with YAML.safe_load_file for improved security.

[Copilot]

Pull request overview

This pull request enhances security by replacing the potentially unsafe YAML.load_file with YAML.safe_load_file to prevent arbitrary code execution vulnerabilities when parsing YAML configuration files.

Changes:

• Replaced YAML.load_file with YAML.safe_load_file in the YAML parser to mitigate security risks
• Updated CHANGELOG.md to document this security improvement

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
lib/active_record/dbt/configuration/parser.rb	Updated YAML loading method from unsafe load_file to safe safe_load_file to prevent arbitrary code execution
CHANGELOG.md	Added entry documenting the security fix in the Unreleased section

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.