Use yaml.safe_load everywhere

src/dstack/_internal/core/backends/kubernetes/utils.py

@@ -185,7 +185,7 @@ def get_context(self, name: Optional[str] = None) -> KubeconfigContext:
 
 
 def kubeconfig_data_to_kubeconfig_dict(kubeconfig_data: str) -> dict:
-    kubeconfig_dict = yaml.load(kubeconfig_data, yaml.FullLoader)
+    kubeconfig_dict = yaml.safe_load(kubeconfig_data)
     if not isinstance(kubeconfig_dict, dict):
         raise TypeError(f"Unexpected kubeconfig_data type: {kubeconfig_dict.__class__.__name__}")
     return kubeconfig_dict

src/dstack/_internal/core/services/repos.py

@@ -105,7 +105,7 @@ def get_repo_creds_and_default_branch(
     # token from gh config
     if os.path.exists(gh_config_path):
         with open(gh_config_path, "r") as f:
-            gh_hosts = yaml.load(f, Loader=yaml.FullLoader)
+            gh_hosts = yaml.safe_load(f)
         _oauth_token = gh_hosts.get(url.host, {}).get("oauth_token")
         if _oauth_token is not None:
             with suppress(RepoInvalidCredentialsError):

src/dstack/_internal/server/services/config.py

@@ -220,7 +220,7 @@ def _load_config(self) -> Optional[ServerConfig]:
                 content = f.read()
         except OSError:
             return
-        config_dict = yaml.load(content, yaml.FullLoader)
+        config_dict = yaml.safe_load(content)
         return ServerConfig.parse_obj(config_dict)
 
     def _save_config(self, config: ServerConfig):
@@ -271,7 +271,7 @@ class _BackendConfigWithCreds(CoreModel):
 
 def config_yaml_to_backend_config(config_yaml: str) -> AnyBackendConfigWithCreds:
     try:
-        config_dict = yaml.load(config_yaml, yaml.FullLoader)
+        config_dict = yaml.safe_load(config_yaml)
     except yaml.YAMLError:
         raise ServerClientError("Error parsing YAML")
     try:

src/tests/_internal/cli/commands/test_project.py

@@ -29,7 +29,7 @@ def test_adds_project(self, capsys: CaptureFixture, tmp_path: Path):
             APIClientMock.assert_called_once_with(base_url="http://127.0.0.1:31313", token="token")
             api_client_mock.projects.get.assert_called_with("project")
         assert exit_code == 0
-        assert yaml.load(cli_config_path.read_text(), yaml.FullLoader) == {
+        assert yaml.safe_load(cli_config_path.read_text()) == {
             "projects": [
                 {
                     "default": True,