fix: use defusedxml instead of minidom

This should be safer and we already depend on it.

Author: nijel

pyproject.toml

@@ -12,6 +12,7 @@ dev = [
   "pyright==1.1.397",
   "pytest-xdist>=3.6.1",
   "types-requests==2.32.0.20250328",
+  "types-defusedxml==0.7.0.20240218",
   "types-python-jose==3.4.0.20250224",
   "types-oauthlib==3.2.0.20250408",
   "types-requests-oauthlib==2.0.0.20250306",
@@ -79,6 +80,7 @@ dev = [
   "pyright==1.1.397",
   "pytest-xdist>=3.6.1",
   "types-requests==2.32.0.20250328",
+  "types-defusedxml==0.7.0.20240218",
   "types-python-jose==3.4.0.20250224",
   "types-oauthlib==3.2.0.20250408",
   "types-requests-oauthlib==2.0.0.20250306",

social_core/backends/tripit.py

@@ -3,7 +3,7 @@
     https://python-social-auth.readthedocs.io/en/latest/backends/tripit.html
 """
 
-from xml.dom import minidom
+from defusedxml import minidom
 
 from .oauth import BaseOAuth1