RUSTSEC-2018-0006: Uncontrolled recursion leads to abort in deserialization

[github-actions]

Uncontrolled recursion leads to abort in deserialization

Details
Package	yaml-rust
Version	0.3.5
URL	chyh1990/yaml-rust#109
Date	2018-09-17
Patched versions	>= 0.4.1

Affected versions of this crate did not prevent deep recursion while
deserializing data structures.

This allows an attacker to make a YAML file with deeply nested structures
that causes an abort while deserializing it.

The flaw was corrected by checking the recursion depth.

See advisory page for additional details.

[tomusdrw]

Upstream issue, we should keep our dependencies up-to-date, but I don't want to pollute our issue tracker.