Update yaml-rust to 0.4.3

[ki-dof]

Version 0.3.5 Vulnerable
chyh1990/yaml-rust#109
Uncontrolled recursion leads to abort in deserialization

[JohnTitor]

Could you resolve the conflict?

[Dylan-DPC-zz]

This has already been fixed in 3.0 candidate.

[JohnTitor]

Hmm, latest master uses 0.4 and the version range can be >=0.4.0 <0.5.0. But the fixed version is 0.4.1 so it's better to specify the patch version?

[Dylan-DPC-zz]

@JohnTitor that should be fine, it will mostly pick the latest version. We don't need to pin it to a single version

[CreepySkeleton]

rust-yaml = "0.4.1" will not pin it to a single version but rather to ">= 0.4.1" which is exactly what we want. Reopening.

[Dylan-DPC-zz]

No it won't. Versions bounds are ^ by default so "0.4.1" is equivalent to "^0.4.1

[CreepySkeleton]

 Yes, and "^0.4.1" is equivalent for ">= 0.4.1 <0.5.0" https://doc.rust-lang.org/cargo/reference/specifying-dependencies.html#caret-requirements  

[Dylan-DPC-zz]

Nevermind. Both of us are saying the same thing.

[pksunkara]

Fixed by #1651