Fix vendored packages and update gopkg.in/yaml.v2 to v2.2.7 (CVE-2019-11253)

[thaJeztah]

commits f7fe884 (#16) and d52f528 () enabled go modules and vendored dependencies, but did not include go-spew as a dependency. This was later on addressed by 3f088a4 (#25), but did not update the vendored files. The first commit is the result of re-running go mod vendor to vendor go-spew.

The second commit updates gopkg.in/yaml.v2 to v2.2.7, which includes a fix for CVE-2019-11253

full diff: go-yaml/yaml@v2.2.2...v2.2.7

includes:

• go-yaml/yaml@caeefd8
  addresses CVE-2019-11253 JSON/YAML parsing vulnerable to resource exhaustion attack
• Tighten restrictions on float decoding go-yaml/yaml#171 Tighten restrictions on float decoding
• Add large document benchmarks, tune alias heuristic, add max depth limits go-yaml/yaml#515 Add large document benchmarks, tune alias heuristic, add max depth limits
• go-yaml/yaml@f90ceb4
  fixes yaml.Unmarshal crashes on "assignment to entry in nil map" go-yaml/yaml#529 yaml.Unmarshal crashes on "assignment to entry in nil map"
• Port stale simple_keys fix to v2 go-yaml/yaml#543 Port stale simple_keys fix to v2
• go-yaml/yaml@1f64d61
  fixes Invalid simple_keys now cause panics later in decode go-yaml/yaml#548 Invalid simple_keys now cause panics later in decode

[thaJeztah]

/assign @dims

[dims]

/approve
/lgtm

thanks @thaJeztah

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dims, thaJeztah

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [dims]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[dims]

/hold

let's cross check the license

[thaJeztah]

let's cross check the license

Good point; thx! Description from GitHub is;

ISC License
A permissive license lets people do anything with your code with proper attribution and without warranty. The ISC license is functionally equivalent to the BSD 2-Clause and MIT licenses, removing some language that is no longer necessary.

But not a lawyer, so don't know if it's problematic; looks like kubernetes itself does vendor it; https://github.com/kubernetes/kubernetes/tree/master/vendor/github.com/davecgh/go-spew

[dims]

perfect! if we are already do it in k/k :)

/hold cancel

[dims]

for the record : https://github.com/kubernetes/kubernetes/blame/master/vendor/github.com/davecgh/go-spew/LICENSE#L1 it's been there for 2+ years