Repository: conan-io/conan

Issue:
Upgrade pyyml
![image](https://user-images.githubusercontent.com/3807515/50815277-cc5a6900-131c-11e9-8fe8-5bd0d248a978.png)



Discussion:
Bad thing is that they are actually pre-releases: https://pypi.org/project/PyYAML/#history

Let's wait for the last day to do it. Anyway, might better a pre-release than a security issue if it works, of course.
How did you know about this security flaw? Could we use a tool check more packages?
This remember me about [Cargo Audit](https://github.com/RustSec/cargo-audit)
Github did it! It is now notifying security issues, so easy thing.
Amazing! :clap: 

Resolving patch:
diff --git a/conans/model/options.py b/conans/model/options.py
--- a/conans/model/options.py
+++ b/conans/model/options.py
@@ -176,7 +176,8 @@ def __init__(self, values=None):
             tokens = k.split(":")
             if len(tokens) == 2:
                 package, option = tokens
-                package_values = self._reqs_options.setdefault(package.strip(), PackageOptionValues())
+                package_values = self._reqs_options.setdefault(package.strip(),
+                                                               PackageOptionValues())
                 package_values.add_option(option, v)
             else:
                 self._package_values.add_option(k, v)
@@ -367,7 +368,7 @@ def __contains__(self, option):
 
     @staticmethod
     def loads(text):
-        return PackageOptions(yaml.load(text) or {})
+        return PackageOptions(yaml.safe_load(text) or {})
 
     def get_safe(self, field):
         return self._data.get(field)
@@ -461,7 +462,8 @@ def propagate_upstream(self, package_values, down_ref, own_ref, pattern_options)
                 modified_value, modified_ref = modified
                 raise ConanException("%s tried to change %s option %s to %s\n"
                                      "but it was already assigned to %s by %s"
-                                     % (down_ref, own_ref, name, value, modified_value, modified_ref))
+                                     % (down_ref, own_ref, name, value,
+                                        modified_value, modified_ref))
             else:
                 if name in pattern_options:  # If it is a pattern-matched option, should check field
                     if name in self._data:
diff --git a/conans/model/settings.py b/conans/model/settings.py
--- a/conans/model/settings.py
+++ b/conans/model/settings.py
@@ -227,7 +227,7 @@ def copy_values(self):
 
     @staticmethod
     def loads(text):
-        return Settings(yaml.load(text) or {})
+        return Settings(yaml.safe_load(text) or {})
 
     def validate(self):
         for field in self.fields:
diff --git a/conans/model/workspace.py b/conans/model/workspace.py
--- a/conans/model/workspace.py
+++ b/conans/model/workspace.py
@@ -139,7 +139,7 @@ def root(self):
 
     def _loads(self, text):
         try:
-            yml = yaml.load(text)
+            yml = yaml.safe_load(text)
             self._generator = yml.pop("generator", None)
             self._name = yml.pop("name", None)
             self._root = [s.strip() for s in yml.pop("root", "").split(",") if s.strip()]


Test patch: