  deps = django==1.4.3
         django-filter==0.5.4
  
  [testenv:py2.7-django1.3]
  basepython = python2.7
  deps = django==1.3.5
         django-filter==0.5.4
         defusedxml==0.3
 
</s>
       defusedxml==0.3
  deps = django==1.4.3
         django-filter==0.5.4
       defusedxml==0.3
  
  [testenv:py2.7-django1.3]
  basepython = python2.7
  deps = django==1.3.5
         django-filter==0.5.4
         defusedxml==0.3
keep add keep keep keep keep keep keep
 defusedxml for security fix.

As per:
http://blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.html
tox.ini