gopkg.in/yaml is unmaintained. Two immediate options:
Similar discussion in prometheus/proposals: prometheus/proposals#49.
Didn't see this discussed elsewhere, so thought it was reasonable to bring up here (and potentially bring a similar change into our other projects).