RUSTSEC-2018-0006: Uncontrolled recursion leads to abort in deserialization

[github-actions]

Uncontrolled recursion leads to abort in deserialization

Details
Package	yaml-rust
Version	0.3.5
URL	chyh1990/yaml-rust#109
Date	2018-09-17
Patched versions	>= 0.4.1

Affected versions of this crate did not prevent deep recursion while
deserializing data structures.

This allows an attacker to make a YAML file with deeply nested structures
that causes an abort while deserializing it.

The flaw was corrected by checking the recursion depth.

See advisory page for additional details.

[Licenser]

Non critical, as it yaml is only used during devl/compile time - reported upstream: clap-rs/clap#1569

[Licenser]

this has been updated