madpah/serializable

defusedxml still required?

开放

#194 创建于 2026年3月5日

 (4 条评论) (0 个反应) (0 位负责人)Python (5 个派生)auto 404
enhancementhelp wanted

仓库指标

星标
 (7 个星标)
PR 合并指标
 (PR 指标待抓取)

描述

In https://github.com/madpah/serializable/pull/5, defusedxml has been introduced as a dependency to prevent XEE attacks.

According to the docs, defusedxml should not be required anymore with recent Python versions and the recommendation for defusedxml has been removed from the official Python docs after some discussions:

According to the table at https://github.com/tiran/defusedxml?tab=readme-ov-file#python-xml-libraries, the mentioned attacks should not be possible with modern Python anymore.

Is the dependency still required here?

贡献者指南