defusedxml >= 0.6.0