Update pyyaml to prevent arbitrary code execution

[sphuber]

Fixes #3310

Before pyyaml==5.1 the yaml.load function was vulnerable to
arbitrary code execution, because it loaded the full set of YAML. There
was an alternative safe_load but this was not the default and could
only load a sub set of the markup language. The new version of pyyaml
deprecates the old vulnerable code and provides the FullLoader that
can load the full set without being vulnerable.

[sphuber]

@ltalirz I have marked it as blocked because it does quite a bit the same as your PR. Once yours is merged I will rebase to include the few remaining warning fixes.

We discussed a long time ago to use ruamel.yaml instead of sticking with pyyaml but the latter seems to be developed again and the vulnerability is fixed. In contrast, the former started really changing the interface where it was a big job to start adapting it all.

Also, it seems like I will have to start updating the whole topika, kiwipy plumpy stack ☹️

[ltalirz]

Once yours is merged I will rebase to include the few remaining warning fixes.

Thanks, please go ahead!

We discussed a long time ago to use ruamel.yaml instead of sticking with pyyaml but the latter seems to be developed again and the vulnerability is fixed. In contrast, the former started really changing the interface where it was a big job to start adapting it all.

Ok, no strong feelings about this. Feel free to close the corresponding issue.

[sphuber]

This depends on a new version of kiwipy that I just released but that isn't on conda-forge yet.

[sphuber]

@ltalirz this is unblocked and good to go

[ltalirz]

Thanks @sphuber !