madpah/serializable

defusedxml still required?

開放

#194 建立於 2026年3月5日

 (4 則留言) (0 個反應) (0 位負責人)Python (5 個分叉)auto 404
enhancementhelp wanted

倉庫指標

星標
 (7 顆星)
PR 合併指標
 (PR 指標待抓取)

描述

In https://github.com/madpah/serializable/pull/5, defusedxml has been introduced as a dependency to prevent XEE attacks.

According to the docs, defusedxml should not be required anymore with recent Python versions and the recommendation for defusedxml has been removed from the official Python docs after some discussions:

According to the table at https://github.com/tiran/defusedxml?tab=readme-ov-file#python-xml-libraries, the mentioned attacks should not be possible with modern Python anymore.

Is the dependency still required here?

貢獻者指南