I think both are needed. See [these imports](https://github.com/toastdriven/django-tastypie/blob/aa8d9fd6869d92aee7052dccabf9fb1a54089bac/tastypie/serializers.py#L15) and [this commit](https://github.com/toastdriven/django-tastypie/commit/aa8d9fd6869d92aee7052dccabf9fb1a54089bac).

Also, your commit should say __defusedxml__, not defusexml.