Repository: astropy/pyvo (language: python)

Issue:
Dependency with XML parser
The code implementing the MIVOT feature (PR #497) uses [lxml.etree](https://pypi.org/project/lxml/). The data model handling requires to run XML operations: parsing and XPATH queries.

However, lxml is not a part of the PyVO dependencies, and is considered insecure as well as the xml native package ([xml documentation](https://docs.python.org/3/library/xml.etree.elementtree.html)), the reason why we have been resilient in using them.

The two possibilities are:
 - use [defusedxml](https://pypi.org/project/defusedxml/) which will also add a new dependency.
 - add the fragment needed of defusedxml in PyVO (defusedxml is on Python Software Foundation License)

What would you recommend? 


Discussion / hints:
Either of them ends up as a dependency they will need to be an optional dependency, e.g imports needs to be done as part of conditionals, test should be skipped when the dependency is missing, etc.
For examples see the case e.g. `regions` in astroquery.

Fix patch:
diff --git a/README.rst b/README.rst
index 46632eed5..802374696 100644
--- a/README.rst
+++ b/README.rst
@@ -57,6 +57,7 @@ The following packages are optional dependencies and are required for the
 full functionality:
 
  * pillow
+ * defusedxml
 
 For running the tests, and building the documentation, the following
 infrastructure packages are required:
diff --git a/docs/dal/index.rst b/docs/dal/index.rst
index 6f664eb4b..d4417b7a4 100644
--- a/docs/dal/index.rst
+++ b/docs/dal/index.rst
@@ -799,7 +799,7 @@ as quantities):
 Datalink
 --------
 
-Datalink lets operators associate multiple artefacts with a dataset.
+Datalink lets operators associate multiple artifacts with a dataset.
 Examples include linking raw data, applicable or applied calibration
 data, derived datasets such as extracted sources, extra documentation,
 and much more.
diff --git a/setup.cfg b/setup.cfg
index dc8eea95d..d53e217c6 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -70,11 +70,11 @@ python_requires = >=3.8
 [options.extras_require]
 all =
     pillow
+    defusedxml
 test =
     pytest-doctestplus>=0.13
     pytest-astropy
     requests-mock
-    defusedxml
 docs =
     sphinx-astropy
 


Test patch:
diff --git a/.github/workflows/ci_tests.yml b/.github/workflows/ci_tests.yml
index d5049e438..e7cf9aa0d 100644
--- a/.github/workflows/ci_tests.yml
+++ b/.github/workflows/ci_tests.yml
@@ -33,9 +33,6 @@ jobs:
           - name: py311 with online tests, Linux
             python-version: '3.11'
             tox_env: py311-test-alldeps-online
-          - name: linkcheck
-            python-version: '3.10'
-            tox_env: linkcheck
 
     steps:
     - name: Checkout code
@@ -87,3 +84,19 @@ jobs:
         run: python -m pip install --upgrade tox
       - name: Check codestyle
         run: tox -e codestyle
+
+  linkcheck:
+    if: github.event_name == 'schedule' && github.repository == 'astropy/pyvo'
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Python 3.10
+        uses: actions/setup-python@v5
+        with:
+          python-version: 3.10
+      - name: Install tox
+        run: python -m pip install --upgrade tox
+      - name: Check docs links
+        run: tox -e linkcheck