bump libyaml to 0.1.6 for CVE-2014-2525