Upgrade gopkg.in/yaml.v2 dependency due to CVE-2019-11254

[Blesmol]

Hi,

I would kindly like to ask whether you could upgrade your dependency to module gopkg.in/yaml.v2 from v2.2.1 to v2.2.8?

There were improvements to the performance in specific cases, fixed by go-yaml/yaml#555, and versions of yaml.v2 without that fix even have a CVE entry, although the description there is a little bit confusing, as it is mainly talking about the K8S API server...

Still, updating from v2.2.1 to v2.2.8 should neither introduce compatibility issues nor other problems. I also did the update locally, and the test suite ran fine. I can also provide a PR that updates the go.mod file and contents of the vendor dir if you want.

Thanks!

[dnaeon]

Hey @Blesmol ,

Please feel free to submit a PR. I'd happy to review and merge it.

Thanks!

[Blesmol]

Hi @dnaeon ,

Thanks! Created new PR #61 for this.

[Blesmol]

Thanks for merging! :)