exclude xmlsec from the deps