pyyaml vulnerability

[johnbradley]

https://nvd.nist.gov/vuln/detail/CVE-2017-18342

Details: yaml/pyyaml#243 (comment)

The suggested version 4.1 is a prerelease so not a good option currently.

According to the details link above using yaml.safe_load instead of yaml.load fixes this issue.

We don't appear to be using yaml directly in our code so we may be able to remove this requirement. The problem may still exist in libraries we are using.

[johnbradley]

We have some YAML fixture files used to populate the database.
If pyyaml is not installed this causes the following error:

ModuleNotFoundError: No module named 'yaml'.

With our current dependencies removing pyyaml from our requirements still results in it being installed.

[dleehr]

Did #212 fix this?

[johnbradley]

Did #212 fix this?
Yes. Closing.