From 88d9f58175c5c0b47975d175faa4a660457a3347 Mon Sep 17 00:00:00 2001
From: Justin Beckwith <jbeckwith@openai.com>
Date: Wed, 15 Jul 2026 16:21:49 -0700
Subject: [PATCH] fix(deps): update test SnakeYAML to 2.6

---
 .../build.gradle.kts                          |  6 ++++
 .../OpenAIClientAutoConfigurationTest.kt      | 33 +++++++++++++++++++
 2 files changed, 39 insertions(+)

diff --git a/openai-java-spring-boot-starter/build.gradle.kts b/openai-java-spring-boot-starter/build.gradle.kts
index fcf71dfe6..a40aa996c 100644
--- a/openai-java-spring-boot-starter/build.gradle.kts
+++ b/openai-java-spring-boot-starter/build.gradle.kts
@@ -14,4 +14,10 @@ dependencies {
 
     testImplementation("org.springframework.boot:spring-boot-starter-test:2.7.18")
     testImplementation("org.assertj:assertj-core:3.27.7")
+
+    constraints {
+        testImplementation("org.yaml:snakeyaml:2.6") {
+            because("avoid known vulnerabilities in Spring Boot's test dependency")
+        }
+    }
 }
diff --git a/openai-java-spring-boot-starter/src/test/kotlin/com/openai/springboot/OpenAIClientAutoConfigurationTest.kt b/openai-java-spring-boot-starter/src/test/kotlin/com/openai/springboot/OpenAIClientAutoConfigurationTest.kt
index 4390a12a8..c9b386667 100644
--- a/openai-java-spring-boot-starter/src/test/kotlin/com/openai/springboot/OpenAIClientAutoConfigurationTest.kt
+++ b/openai-java-spring-boot-starter/src/test/kotlin/com/openai/springboot/OpenAIClientAutoConfigurationTest.kt
@@ -3,11 +3,14 @@
 package com.openai.springboot
 
 import com.openai.client.OpenAIClient
+import java.nio.charset.StandardCharsets
 import org.assertj.core.api.Assertions.assertThat
 import org.junit.jupiter.api.Test
 import org.springframework.beans.factory.getBean
 import org.springframework.boot.autoconfigure.AutoConfigurations
+import org.springframework.boot.env.YamlPropertySourceLoader
 import org.springframework.boot.test.context.runner.ApplicationContextRunner
+import org.springframework.core.io.ByteArrayResource
 
 internal class OpenAIClientAutoConfigurationTest {
 
@@ -37,6 +40,36 @@ internal class OpenAIClientAutoConfigurationTest {
             }
     }
 
+    @Test
+    fun yamlProperties() {
+        val resource =
+            ByteArrayResource(
+                """
+                openai:
+                  base-url: https://api.openai.com/v1
+                  api-key: YAML API Key
+                  org-id: YAML Organization
+                """
+                    .trimIndent()
+                    .toByteArray(StandardCharsets.UTF_8)
+            )
+        val propertySources = YamlPropertySourceLoader().load("test", resource)
+
+        contextRunner
+            .withInitializer { context ->
+                propertySources.reversed().forEach {
+                    context.environment.propertySources.addFirst(it)
+                }
+            }
+            .run { context ->
+                val properties = context.getBean<OpenAIClientProperties>()
+                assertThat(properties.baseUrl).isEqualTo("https://api.openai.com/v1")
+                assertThat(properties.apiKey).isEqualTo("YAML API Key")
+                assertThat(properties.organization).isEqualTo("YAML Organization")
+                context.getBean<OpenAIClient>()
+            }
+    }
+
     @Test
     fun client() {
         contextRunner