Docker Compose and PyYAML version are incompatible

[kush-jain]

ATLAS in its alpha phase used PyYAML==3.13, which was found to be insecure.
However, the latest PyYAML version (5.1) is not supported by docker-compose.

We need to keep an eye on these two issues to find the best way forward
docker/compose#6619
yaml/pyyaml#265

Currently, we are using PyYAML==4.2b1 to resolve this incompatibility, but we want to migrate to a stable build.

[rmwenzel]

Ran into this issue trying to use sagemaker and keras in the same environment. Thanks @kush-jain for pointing out which version resolves it.

[boblannon]

+1 thanks for pointing this out. In case it's helpful to others, pipenv throws an error that looks like:

[pipenv.exceptions.ResolutionFailure]:       Tried: 3.10, 3.10, 3.11, 3.11, 3.12, 3.12, 3.12, 3.12, 3.12, 3.12, 3.12, 3.12, 3.13, 3.13, 3.13, 3.13, 3.13, 3.13, 3.13, 3.13, 3.13, 3.13, 3.13, 5.1, 5.1, 5.1, 5.1, 5.1, 5.1, 5.1, 5.1, 5.1, 5.1, 5.1, 5.1.1, 5.1.1, 5.1.1, 5.1.1, 5.1.1, 5.1.1, 5.1.1, 5.1.1, 5.1.1, 5.1.1, 5.1.1, 5.1.2, 5.1.2, 5.1.2, 5.1.2, 5.1.2, 5.1.2, 5.1.2, 5.1.2, 5.1.2, 5.1.2, 5.1.2, 5.1.2, 5.1.2, 5.2, 5.2, 5.2, 5.2, 5.2, 5.2, 5.2, 5.2, 5.2, 5.2, 5.2, 5.3, 5.3, 5.3, 5.3, 5.3, 5.3, 5.3, 5.3, 5.3, 5.3, 5.3, 5.3.1, 5.3.1, 5.3.1, 5.3.1, 5.3.1, 5.3.1, 5.3.1, 5.3.1, 5.3.1, 5.3.1, 5.3.1
[pipenv.exceptions.ResolutionFailure]:       Skipped pre-versions: 3.13b1, 3.13b1, 3.13b1, 3.13b1, 3.13b1, 3.13b1, 3.13b1, 3.13b1, 3.13b1, 3.13b1, 3.13rc1, 3.13rc1, 3.13rc1, 3.13rc1, 3.13rc1, 3.13rc1, 3.13rc1, 3.13rc1, 3.13rc1, 3.13rc1, 3.13rc1, 4.2b1, 4.2b2, 4.2b4, 4.2b4, 4.2b4, 4.2b4, 4.2b4, 5.1b1, 5.1b3, 5.1b5, 5.1b5, 5.1b5, 5.1b5, 5.1b5, 5.1b5, 5.1b5, 5.1b5, 5.1b5, 5.1b5, 5.1b5, 5.1b7, 5.2b1, 5.2b1, 5.2b1, 5.2b1, 5.2b1, 5.2b1, 5.2b1, 5.2b1, 5.2b1, 5.2b1, 5.2b1, 5.2b1, 5.2b1, 5.3b1, 5.3b1, 5.3b1, 5.3b1, 5.3b1, 5.3b1, 5.3b1, 5.3b1, 5.3b1, 5.3b1, 5.3b1
[pipenv.exceptions.ResolutionFailure]: Warning: Your dependencies could not be resolved. You likely have a mismatch in your sub-dependencies.
  First try clearing your dependency cache with $ pipenv lock --clear, then try the original command again.
 Alternatively, you can use $ pipenv install --skip-lock to bypass this mechanism, then run $ pipenv graph to inspect the situation.
  Hint: try $ pipenv lock --pre if it is a pre-release dependency.
ERROR: ERROR: Could not find a version that matches pyyaml<6,==4.2b1,>=3.10

as the hint in the error suggests, you can resolve this by running

pipenv lock --pre