jekyll/jekyll — pull request #1982 by dtao (2014-01-24 01:57:30+00:00)
Title: Require 'safe_yaml/load' instead of 'safe_yaml'

Originally I intended for SafeYAML to be used by application developers, and so it made sense to patch `YAML.load` to protect an application against YAML-related deserialization exploits that could creep in *anywhere*, either in the application code or in some library dependency. Over time (see dtao/safe_yaml#47) it's become clear that there's another totally legit use case, which is a library that wants to deserialize YAML safely but *doesn't* want to do any crazy patching of global modules.

I think jekyll fits this use case, which means it probably ought to just require "safe_yaml/load" and not monkeypatch the `YAML` module with potential ripple effects. See for example dtao/safe_yaml#53, which is an issue caused for a project that's apparently using both jekyll and sidekiq.