Auto merge of #28305 - servo:dependabot/pip/python/tidy/pyyaml-5.4, r=jdm

build(deps): bump pyyaml from 5.1 to 5.4 in /python/tidy

Bumps [pyyaml](https://github.com/yaml/pyyaml) from 5.1 to 5.4.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/yaml/pyyaml/blob/master/CHANGES">pyyaml's changelog</a>.</em></p>
<blockquote>
<p>5.4 (2021-01-19)</p>
<ul>
<li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/407">yaml/pyyaml#407</a> -- Build modernization, remove distutils, fix metadata, build wheels, CI to GHA</li>
<li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/472">yaml/pyyaml#472</a> -- Fix for CVE-2020-14343, moves arbitrary python tags to UnsafeLoader</li>
<li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/441">yaml/pyyaml#441</a> -- Fix memory leak in implicit resolver setup</li>
<li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/392">yaml/pyyaml#392</a> -- Fix py2 copy support for timezone objects</li>
<li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/378">yaml/pyyaml#378</a> -- Fix compatibility with Jython</li>
</ul>
<p>5.3.1 (2020-03-18)</p>
<ul>
<li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/386">yaml/pyyaml#386</a> -- Prevents arbitrary code execution during python/object/new constructor</li>
</ul>
<p>5.3 (2020-01-06)</p>
<ul>
<li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/290">yaml/pyyaml#290</a> -- Use <code>is</code> instead of equality for comparing with <code>None</code></li>
<li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/270">yaml/pyyaml#270</a> -- Fix typos and stylistic nit</li>
<li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/309">yaml/pyyaml#309</a> -- Fix up small typo</li>
<li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/161">yaml/pyyaml#161</a> -- Fix handling of <strong>slots</strong></li>
<li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/358">yaml/pyyaml#358</a> -- Allow calling add_multi_constructor with None</li>
<li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/285">yaml/pyyaml#285</a> -- Add use of safe_load() function in README</li>
<li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/351">yaml/pyyaml#351</a> -- Fix reader for Unicode code points over 0xFFFF</li>
<li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/360">yaml/pyyaml#360</a> -- Enable certain unicode tests when maxunicode not &gt; 0xffff</li>
<li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/359">yaml/pyyaml#359</a> -- Use full_load in yaml-highlight example</li>
<li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/244">yaml/pyyaml#244</a> -- Document that PyYAML is implemented with Cython</li>
<li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/329">yaml/pyyaml#329</a> -- Fix for Python 3.10</li>
<li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/310">yaml/pyyaml#310</a> -- Increase size of index, line, and column fields</li>
<li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/260">yaml/pyyaml#260</a> -- Remove some unused imports</li>
<li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/163">yaml/pyyaml#163</a> -- Create timezone-aware datetimes when parsed as such</li>
<li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/363">yaml/pyyaml#363</a> -- Add tests for timezone</li>
</ul>
<h2>5.2 (2019-12-02)</h2>
<ul>
<li>Repair incompatibilities introduced with 5.1. The default Loader was changed,
but several methods like add_constructor still used the old default
<a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/279">yaml/pyyaml#279</a> -- A more flexible fix for custom tag constructors
<a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/287">yaml/pyyaml#287</a> -- Change default loader for yaml.add_constructor
<a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/305">yaml/pyyaml#305</a> -- Change default loader for add_implicit_resolver, add_path_resolver</li>
<li>Make FullLoader safer by removing python/object/apply from the default FullLoader
<a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/347">yaml/pyyaml#347</a> -- Move constructor for object/apply to UnsafeConstructor</li>
<li>Fix bug introduced in 5.1 where quoting went wrong on systems with sys.maxunicode &lt;= 0xffff
<a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/276">yaml/pyyaml#276</a> -- Fix logic for quoting special characters</li>
<li>Other PRs:
<a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/280">yaml/pyyaml#280</a> -- Update CHANGES for 5.1</li>
</ul>
<h2>5.1.2 (2019-07-30)</h2>
<ul>
<li>Re-release of 5.1 with regenerated Cython sources to build properly for Python 3.8b2+</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="58d0cb7ee0"><code>58d0cb7</code></a> 5.4 release</li>
<li><a href="a60f7a19c0"><code>a60f7a1</code></a> Fix compatibility with Jython</li>
<li><a href="ee98abd7d7"><code>ee98abd</code></a> Run CI on PR base branch changes</li>
<li><a href="ddf20330be"><code>ddf2033</code></a> constructor.timezone: _<em>copy</em> &amp; <strong>deepcopy</strong></li>
<li><a href="fc914d52c4"><code>fc914d5</code></a> Avoid repeatedly appending to yaml_implicit_resolvers</li>
<li><a href="a001f27825"><code>a001f27</code></a> Fix for CVE-2020-14343</li>
<li><a href="fe15062414"><code>fe15062</code></a> Add 3.9 to appveyor file for completeness sake</li>
<li><a href="1e1c7fb7c0"><code>1e1c7fb</code></a> Add a newline character to end of pyproject.toml</li>
<li><a href="0b6b7d6171"><code>0b6b7d6</code></a> Start sentences and phrases for capital letters</li>
<li><a href="c97691596e"><code>c976915</code></a> Shell code improvements</li>
<li>Additional commits viewable in <a href="https://github.com/yaml/pyyaml/compare/5.1...5.4">compare view</a></li>
</ul>
</details>
<br />

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pyyaml&package-manager=pip&previous-version=5.1&new-version=5.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/servo/servo/network/alerts).

</details>

python/tidy/setup.py

@@ -18,7 +18,7 @@ install_requires = [
     "toml==0.9.2",
     "colorama==0.3.7",
     "voluptuous==0.11.5",
-    "PyYAML==5.1",
+    "PyYAML==5.4",
 ]
 
 here = os.path.dirname(os.path.abspath(__file__))