According to the advisory there is a maintained fork.
edit: I might have been too quick in connecting dots, early morning. The advisory is talking about the yaml-rust crate, while you were talking about serde_yaml. Sorry about that.
Forking is always an option, perhaps just providing the serde wrappers?