RUSTSEC-2018-0006: Uncontrolled recursion leads to abort in deserialization

[github-actions]

Uncontrolled recursion leads to abort in deserialization

Details
Package	yaml-rust
Version	0.3.5
URL	chyh1990/yaml-rust#109
Date	2018-09-17
Patched versions	>= 0.4.1

Affected versions of this crate did not prevent deep recursion while
deserializing data structures.

This allows an attacker to make a YAML file with deeply nested structures
that causes an abort while deserializing it.

The flaw was corrected by checking the recursion depth.

See advisory page for additional details.

[notheotherben]

This appears to be a dependency of clap@2.33.1 - so we'll need to wait until they update it (or switch to clap@3.0.0 when it becomes GA.

Since we're not using any of the YAML functionality within clap, this is likely not an issue for our use case.