Skip to content

Docker images not shipping with defusedxml

Moving the thread here.

I am running diffoscope 294 over two XML files (attached as txt files reference.txt rebuild.txt). I get a diff using XXD instead of plain text diff because of the following error message:

2025-04-21 13:51:26 W: diffoscope.comparators.xml: Vulnerable version of pyexpat detected; disabling comparison of XML documents. Install defusedxml or upgrade your pyexpat.

Note that this is not visible when output type is JSON.

However, when I install defusedxml, it works and gives a nice diff like below.

│ -          <description>Specifies the Proxy Configuration Controller Service to proxy network requests. If set, it supersedes proxy settings configured per component. Supported proxies: SOCKS + AuthN, HTTP + AuthN</description>
│ +          <description>Specifies the Proxy Configuration Controller Service to proxy network requests. If set, it supersedes proxy settings configured per component. Supported proxies: HTTP + AuthN, SOCKS + AuthN</description>

Is there a specific reason that defusedxml is not shipped with the docker image?

Edited by Aman Sharma
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information