Regression due to ruamel.yaml

Potentially dangerous regression in config box, due to the new ruamel.yaml dependency.

>>> from box import ConfigBox
>>> b = ConfigBox.from_yaml("kill_all_humans_mode: no")
>>> if b.kill_all_humans_mode: 
...     print("ok, killing all humans...") 
...
ok, killing all humans...

Same problem with box.Box. Our test suite caught this, but others might not be so lucky. ruamel isn’t exactly a drop-in replacement for yaml, despite claims to the contrary (ruamel defaults to spec 1.2 and yaml is spec 1.1).

I would advise to make the toml and ruamel.yaml dependencies optional (or “soft” dependencies, like it was in 3.x) since users might prefer other providers such as pytoml and PyYAML and you don’t want to tie their hands here.

Personally, I can not use box>=4 at all because the ruamel.yaml has an insane installer which, for various reasons, does not work in the prod environment at $EMPLOYER.

[cdgriffith]

As an update to this, Box 5.0 will go back to being able to be pure python, and installing additional extras as requested. https://github.com/cdgriffith/Box/wiki/Installation

[wimglenn]

See https://setuptools.readthedocs.io/en/latest/setuptools.html#declaring-extras-optional-features-with-their-own-dependencies