XML bomb protection for Python stdlib modules, an xml serialiser
https://github.com/tiran/defusedxml/