update safe_yaml, as 0.9.4 was yanked