Moving the [thread](https://lists.reproducible-builds.org/pipermail/diffoscope/2025-April/002841.html) here. I am running diffoscope 294 over two XML files (attached as txt files [reference.txt](/uploads/ad67f6d29aa5056316686bba9267520b/reference.txt) [rebuild.txt](/uploads/622bf46a7fc9a046e2af34ffab924e73/rebuild.txt)). I get a diff using XXD instead of plain text diff because of the following error message: ``` 2025-04-21 13:51:26 W: diffoscope.comparators.xml: Vulnerable version of pyexpat detected; disabling comparison of XML documents. Install defusedxml or upgrade your pyexpat. ``` Note that this is not visible when output type is JSON. However, when I install `defusedxml`, it works and gives a nice diff like below. ```diff │ - <description>Specifies the Proxy Configuration Controller Service to proxy network requests. If set, it supersedes proxy settings configured per component. Supported proxies: SOCKS + AuthN, HTTP + AuthN</description> │ + <description>Specifies the Proxy Configuration Controller Service to proxy network requests. If set, it supersedes proxy settings configured per component. Supported proxies: HTTP + AuthN, SOCKS + AuthN</description> ``` Is there a specific reason that defusedxml is not shipped with the docker image?