pyyaml vulnerability

[johnbradley]

https://nvd.nist.gov/vuln/detail/CVE-2017-18342

Details: yaml/pyyaml#243 (comment)

The suggested version 4.1 is a prerelease so not a good option currently.

According to the details link above using yaml.safe_load instead of yaml.load fixes this issue.

We don't appear to be using yaml directly in our code so we may be able to remove this requirement. The problem may still exist in libraries we are using.