cargo-audit reports dependency on insecure yaml-rust

[matthiaskrgr]

clap depends on yaml-rust 0.3.5 which is flagged as insecure:

   Fetching advisory database from `https:/RustSec/advisory-db.git`
      Loaded 14 security advisories (from /home/matthias/.cargo/advisory-db)
    Scanning Cargo.lock for vulnerabilities (51 crate dependencies)
error: Vulnerable crates found!

ID:  RUSTSEC-2018-0006
Crate:   yaml-rust
Version: 0.3.5
Date:    2018-09-17
URL:     https:/chyh1990/yaml-rust/pull/109
Title:   Uncontrolled recursion leads to abort in deserialization
Solution: upgrade to: >= 0.4.1

error: 1 vulnerability found!

is it possible to update to 0.4 ?

[DemiMarie]

This isn’t exploitable, since the YAML comes from the app developer and is thus trusted. That said, it should still be fixed.

[Dylan-DPC-zz]

This will be fixed when #1541 is merged

[Dylan-DPC-zz]

Uhmm, this is fixed in 3.0 candidate. Thanks