I have applied this workaround to pandas. However, this only makes
pandas use xlrd less; this bug still exists in other users of xlrd when
defusedxml is installed. By default this includes python3-glue (the
original reason for upgrading xlrd), via the Recommends/Depends chain
python3-glue -> python3-pandas -> python3-odf -> python3-defusedxml.
