fix(ci): restore defusedxml dependency parity

scripts/pre_push_checks.sh

@@ -213,6 +213,11 @@ if ! "$VENV_PY" -c "import cryptography" >/dev/null 2>&1; then
   echo "[pre-push] INFO: installing cryptography into project venv ($VENV_DIR) ..." >&2
   pip_install_or_fail "required for S57 secrets-at-rest encryption paths/tests" cryptography
 fi
+if ! "$VENV_PY" -c "import defusedxml" >/dev/null 2>&1; then
+  # IMPORTANT: keep local/CI parity with requirements.txt and WeChat ingress tests.
+  echo "[pre-push] INFO: installing defusedxml into project venv ($VENV_DIR) ..." >&2
+  pip_install_or_fail "required for S85 fail-closed XML parsing paths/tests" defusedxml
+fi
 
 require_cmd npm
 

scripts/preflight_check.py

@@ -6,7 +6,7 @@ Validates the build environment before deployment or test execution.
 Checks:
 1. Python version (>=3.10)
 2. Node.js version (>=18.0.0, per package.json + TEST_SOP)
-3. Essential Python dependencies (cryptography)
+3. Essential Python dependencies (cryptography, defusedxml)
 
 Usage:
     python scripts/preflight_check.py [--strict]
@@ -23,6 +23,7 @@ MIN_NODE_VERSION = (18, 0, 0)
 
 REQUIRED_PYTHON_PACKAGES = [
     ("cryptography", "41.0"),
+    ("defusedxml", "0.7.1"),
 ]
 
 # Colors for output

scripts/run_full_tests_linux.sh

@@ -123,6 +123,11 @@ if ! "$VENV_PY" -c "import cryptography" >/dev/null 2>&1; then
   echo "[tests] Installing cryptography into project venv ($VENV_DIR) ..."
   pip_install_or_fail "required for S57 secrets-at-rest encryption tests" cryptography
 fi
+if ! "$VENV_PY" -c "import defusedxml" >/dev/null 2>&1; then
+  # IMPORTANT: keep local full-test bootstrap aligned with requirements.txt.
+  echo "[tests] Installing defusedxml into project venv ($VENV_DIR) ..."
+  pip_install_or_fail "required for S85 fail-closed XML parsing tests" defusedxml
+fi
 
 NODE_MAJOR="$(node -p "process.versions.node.split('.')[0]")"
 if [ "$NODE_MAJOR" -lt 18 ]; then

scripts/run_full_tests_windows.ps1

@@ -169,6 +169,17 @@ if (-not $hasCryptography) {
   Invoke-Checked "pip install cryptography" { & $venvPython -m pip install cryptography }
 }
 
+$hasDefusedXml = $true
+& $venvPython -c "import defusedxml" | Out-Null
+if ($LASTEXITCODE -ne 0) {
+  $hasDefusedXml = $false
+}
+if (-not $hasDefusedXml) {
+  # IMPORTANT: keep Windows full-test bootstrap aligned with requirements.txt.
+  Write-Host "[tests] Installing defusedxml into project venv (S85 fail-closed XML parsing) ..."
+  Invoke-Checked "pip install defusedxml" { & $venvPython -m pip install defusedxml }
+}
+
 # Ensure Node >= 18
 $nodeMajor = [int]((& node -p "process.versions.node.split('.')[0]").Trim())
 if ($nodeMajor -lt 18) {