pyyaml security vulnerability

[1fish2]

GitHub warns @eagmon of security vulnerabilities in 2 packages we're using. (Why doesn't it show this warning to me???)

pyyaml does not seem to have any release notes or docs on how to handle this vulnerability! One has to dig through their "closed" issues and wiki to learn about this. In short, yaml.load() can run arbitrary Python code. Their wiki says this vulnerability goes back to their first release, it's documented, and they aren't going to break compatibility by making yaml.load() safe.

Release 5.1 doesn't really fix the vulnerability other than print a deprecation warning from yaml.load().

yaml/pyyaml#243
yaml/pyyaml#193
https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation

/usr/local/var/pyenv/versions/wcEcoli2/lib/python2.7/site-packages $ grep 'Requires.*yaml' */METADATA
FireWorks-1.8.7.dist-info/METADATA:Requires-Dist: ruamel.yaml (>=0.15.35)
monty-1.0.3.dist-info/METADATA:Requires-Dist: ruamel.yaml; extra == 'yaml'
ruamel.yaml-0.15.43.dist-info/METADATA:Requires-Dist: ruamel.yaml.jinja2 (>=0.2); extra == 'jinja2'

We should:

• switch from calling yaml.load() to yaml.safe_load() to ensure it can't run arbitrary Python code (we use it to load yaml files from Ecocyc, so this does matter)
• update pyyaml from 3.13 to 5.1 -- mainly to avoid GitHub's security alert; the update doesn't do a lot for security
• figure out whether Fireworks, ruamel.yaml, and monty pips that call yaml can update to v5.1 of pyyaml
• figure out which of those pips have incompatible changes
• and test.