deps: update to use pyyaml 6

[chenrui333]

relates to Homebrew/homebrew-core#136978
also relates to yaml/pyyaml#723 yaml/pyyaml#601

[kurtmckee]

PyYAML 6 dropped support for Python 2.7, which dotbot still supports.

[anishathalye]

This might be the reason to drop support for Python 2.7, when our dependencies no longer support it (and upgrading dependencies is the easiest solution to problems like that posted in the OP).

[johnlettman]

I advocate for discontinuing support for Python 2.7 due to several reasons:

1. End-of-Life Status: Python 2.7 has been beyond its end-of-life for about three years now, following its last extension after the official sunsetting. Consequently, Python 2 is no longer available for download on the Python website.
2. Trend in Python Projects: Numerous prominent frameworks, projects, and packages, such as OpenStack, have already transitioned to Python 3, leaving Python 2 behind.
3. Improved Features: Python 3 offers several enhancements that can significantly enhance development. Notably, the typing features have proven valuable in my personal experience.

and, of course

4. Security: Dotbot, its plugins, and the users can benefit from the usage
   of supported Python interpreters and latest dependency updates through the
   switch. It can resolve the following CVE:

   Improper Input Validation in PyYAML / CVE-2020-14343 / GHSA-8q59-q68h-6hv4 / A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.

[johnlettman]

I reckon the README already suggests no Python 2:

dotbot/README.md

Lines 70 to 71 in 712b30a

	`install.ps1` script instead of `install`. On Windows, Dotbot only supports
	Python 3.8+, and it requires that your account is [allowed to create symbolic

Anyways, I would be happy to help out with it too.

[rht]

I am not able to install docbot properly via pip on Python 3.11. The reasons is the <6 pyyaml version constraint. pyyaml supported Python 3.11 only recently: yaml/pyyaml@957ae4d. You have to choose to support either of 3.11 or 2.7. I'd vote for supporting 3.11 and dropping EOL 2.7.

[chenrui333]

PyYAML 6 dropped support for Python 2.7, which dotbot still supports.

python 2.7 has been EOL for quite some time, and macOS has not shipped it by default either, also all package managers stop shipping packages using py2, so it would be good to just drop it and then prep for the upcoming py3.12 release :) just my two cents.

[anishathalye]

I'm on board with this plan to drop Py2 support; will process these recent PRs when I get some free time.

[anishathalye]

Thank you for the PR. I didn't just want to remove the version specification altogether; alternative change in b732baf (you're credited in there).

Thanks all for your patience. This is included in Dotbot 1.20.0 and released on PyPI.