pyyaml inconsistent version in Pip lock files and security warning about agogosml HOT 3 CLOSED

This isn't a security issue. Pipfile.lock includes both dev and non-dev dependencies. Pipfiles also collapse the dependency tree. The below files all reference a version greater than pyyaml = ">=4.2b1":

./agogosml/Pipfile
./agogosml/Pipfile.lock  
./agogosml/setup.py

The security warning is triggered only for the ./agogosml_cli/Pipfile.lock file. There is a dev dependency in the agogosml_cli Pipfile that includes an old version of pyyaml hence why the security warning appears. When you do pip install agogosml_cli, you aren't pulling down pyyaml. You can verify yourself by deleting all the dev dependencies and regenerating the Pipfile.lock (no pyyaml). Happy to push a Pipfile.lock for agogosml_cli that doesn't include the dev dependencies to make the security warning go away but that requires me to remove the offending dev dependency from the Pipfile and include manual instructions to install. IMO it's not worth it.

P.S. @cicorias only repository admins can see GitHub security warnings. Please email directly about security warnings instead of posting as an issue. (I made you an admin today 😉 )

from agogosml.

Just as a note: the pyyaml dependency is pulled in as a transitive dependency of watchdog which is used for make servedocs.

from agogosml.

Note that the root cause of this was resolved in #229 since pipenv was replaced with pip.

from agogosml.