RUSTSEC-2018-0006: Uncontrolled recursion leads to abort in deserialization

[github-actions]

Uncontrolled recursion leads to abort in deserialization

Details
Package	yaml-rust
Version	0.3.5
URL	chyh1990/yaml-rust#109
Date	2018-09-17
Patched versions	>= 0.4.1

Affected versions of this crate did not prevent deep recursion while
deserializing data structures.

This allows an attacker to make a YAML file with deeply nested structures
that causes an abort while deserializing it.

The flaw was corrected by checking the recursion depth.

See advisory page for additional details.

[shuni64]

This doesn't really affect us. The only yaml file read by clap is embedded in the binary, so unless the attacker modifies it there's no way that this bug can be triggered.

Regardless of the low impact of this bug, this issue can be left open until we update clap to version 3 (not released yet), which doesn't have the problem anymore.