I was wondering why we decided to use defusedxml as a required dependency for parsing XML instead of the standard library. The docs state that defusedxml should be used for server code, which definitely does not apply to MNE. Since we have a very strict policy for adding required dependencies, I'm a bit surprised that this was added without much discussion.