I'm using Bandit to target some code review, and it raised some concerns about the xml parser we're using in the sbom section. Having looked at these issues in the past: the xml attacks are largely ...

The :mod:`xml.etree.ElementTree` module is not secure against maliciously constructed data. If you need to parse untrusted or unauthenticated data see :ref:`xml-vulnerabilities`. This is a short ...