docs: clarify stdlib xml vs defusedxml usage at every import site

All XML parsing of server responses already uses defusedxml (safe against
XXE/entity expansion). Stdlib xml is retained only for building outbound
request bodies (no defusedxml equivalent) and for the ParseError exception
type (which defusedxml raises unchanged). Added inline comments at each
import site so future contributors don't replace these with defusedxml
unnecessarily, and updated pyproject.toml dependency comment to explain
the split.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: jacalata

pyproject.toml

@@ -13,7 +13,7 @@ license-files = ["LICENSE"]
 readme = "README.md"
 
 dependencies = [
-    'defusedxml>=0.7.1',  # latest as at 7/31/23
+    'defusedxml>=0.7.1',  # latest as at 7/31/23; use for all XML parsing — stdlib xml is unsafe against XXE. XML building (Element/SubElement/tostring) still uses stdlib as defusedxml has no equivalents.
     'packaging>=23.1',   # latest as at 7/31/23
     'requests>=2.32',  # latest as at 7/31/23
     'urllib3>=2.6.0,<3',

tableauserverclient/models/collection_item.py

@@ -1,5 +1,5 @@
 from datetime import datetime
-from xml.etree.ElementTree import Element
+from xml.etree.ElementTree import Element  # building XML request bodies only; use defusedxml for parsing
 
 from defusedxml.ElementTree import fromstring
 from typing_extensions import Self

tableauserverclient/models/data_freshness_policy_item.py

@@ -1,4 +1,4 @@
-import xml.etree.ElementTree as ET
+import xml.etree.ElementTree as ET  # building XML request bodies only; use defusedxml for parsing
 
 from tableauserverclient.models.property_decorators import property_is_enum, property_not_nullable
 from .interval_item import IntervalItem

tableauserverclient/models/datasource_item.py

@@ -1,6 +1,6 @@
 import copy
 import datetime
-import xml.etree.ElementTree as ET
+import xml.etree.ElementTree as ET  # building XML request bodies only; use defusedxml for parsing
 
 from defusedxml.ElementTree import fromstring
 

tableauserverclient/models/extract_item.py

@@ -1,5 +1,5 @@
 from defusedxml.ElementTree import fromstring
-import xml.etree.ElementTree as ET
+import xml.etree.ElementTree as ET  # building XML request bodies only; use defusedxml for parsing
 
 
 class ExtractItem:

tableauserverclient/models/flow_item.py

@@ -1,7 +1,7 @@
 from collections.abc import Iterable
 import copy
 import datetime
-import xml.etree.ElementTree as ET
+import xml.etree.ElementTree as ET  # building XML request bodies only; use defusedxml for parsing
 
 from defusedxml.ElementTree import fromstring
 

tableauserverclient/models/groupset_item.py

@@ -1,4 +1,4 @@
-import xml.etree.ElementTree as ET
+import xml.etree.ElementTree as ET  # building XML request bodies only; use defusedxml for parsing
 
 from defusedxml.ElementTree import fromstring
 from typing_extensions import Self

tableauserverclient/models/location_item.py

@@ -1,4 +1,4 @@
-import xml.etree.ElementTree as ET
+import xml.etree.ElementTree as ET  # building XML request bodies only; use defusedxml for parsing
 
 
 class LocationItem:

tableauserverclient/models/metric_item.py

@@ -1,4 +1,4 @@
-import xml.etree.ElementTree as ET
+import xml.etree.ElementTree as ET  # building XML request bodies only; use defusedxml for parsing
 from datetime import datetime
 
 from tableauserverclient.datetime_helpers import parse_datetime

tableauserverclient/models/permissions_item.py

@@ -1,4 +1,4 @@
-import xml.etree.ElementTree as ET
+import xml.etree.ElementTree as ET  # building XML request bodies only; use defusedxml for parsing
 
 from defusedxml.ElementTree import fromstring