Soften requirement for pyyaml

[theianrobertson]

There's a strict dependency on a specific version of pyyaml, but some times I'm trying to use this alongside other packages that may have a range. For example if I install pre-commit to my environment first, it installs the latest pyyaml:

https://github.com/pre-commit/pre-commit/blob/master/setup.cfg#L32

What are your thoughts on having a minimum version for pyyaml but leaving the max version out? Since this doesn't rely on a huge amount of the yaml package?

[fdosani]

There was a security issue with PyYAML earlier: See Issue #25
I think the current pinned version should be the min. I see they are up to v5 now.

[theianrobertson]

Cool - What do you think about just having a min version in that case? Or do you want to keep a max?

[fdosani]

can we peg to a min 5.1? I'm cool with doing that if that is OK?