We should still plan to remove them completely for 3.0. So maybe we should also mention that in the message.

We may also want to mention the security issue (especially since we are removing a function w/out deprecating it).

Okay I've updated the exception messages w/ a note about security and a note that the message will be removed in 3.0. Here's an example:

>>> nx.read_yaml
Traceback (most recent call last)
   ...
ImportError: 
read_yaml has been removed from NetworkX, please use `yaml`
directly:

    import yaml

    with open('path', 'r') as fh:
        yaml.load(fh, Loader=yaml.Loader)

Note that yaml.Loader is considered insecure - see the pyyaml
documentation for further details.

This message will be removed in NetworkX 3.0.

I like the __getattr__ approach in that it raises an exception whenever a user tries to load/access the modules/functions rather than deferring to when users try to run the functions. One thing I don't like about this approach though is the fact that I had to repead the def __getattr__ definition in multiple places in order to cover all the previous access patterns (e.g. nx.read_yaml, nx.readwrite.read_yaml, nx.readwrite.nx_yaml.read_yaml, etc.). Maybe there's a better way to do this?

Thank you for fixing the pyyaml dependency. Do you know when this fix will be released? The security bug, CVE-2020-1747, has been flag as a high severity for us and is currently a show stopper.

The milestone date for v2.6 is May 31. We are aiming to be close to that.

Add a note about extra files to: https://github.com/networkx/networkx/blob/main/doc/developer/deprecations.rst

I've updated the deprecation notes and removed the yaml section from the docs. I could've left the yaml section in there as a stub with a warning, but I decided to be more aggressive. If there's a preference for leaving a docs stub with a warning LMK and I'll add it back!