diff --git a/fdroidserver/build.py b/fdroidserver/build.py
index 1f820cc2..83065dbb 100644
--- a/fdroidserver/build.py
+++ b/fdroidserver/build.py
@@ -888,7 +888,6 @@ timeout_event = threading.Event()
 
 
 def main():
-
     global options, config, buildserverid, fdroidserverid
 
     options, parser = parse_commandline()
diff --git a/fdroidserver/checkupdates.py b/fdroidserver/checkupdates.py
index 26a78fae..598fe620 100644
--- a/fdroidserver/checkupdates.py
+++ b/fdroidserver/checkupdates.py
@@ -590,7 +590,6 @@ start_timestamp = time.gmtime()
 
 
 def main():
-
     global config, options
 
     # Parse command line...
diff --git a/fdroidserver/common.py b/fdroidserver/common.py
index 3905c45e..df8d686c 100644
--- a/fdroidserver/common.py
+++ b/fdroidserver/common.py
@@ -51,11 +51,7 @@ import tempfile
 import json
 from pathlib import Path
 
-# TODO change to only import defusedxml once its installed everywhere
-try:
-    import defusedxml.ElementTree as XMLElementTree
-except ImportError:
-    import xml.etree.ElementTree as XMLElementTree  # nosec this is a fallback only
+import defusedxml.ElementTree as XMLElementTree
 
 from base64 import urlsafe_b64encode
 from binascii import hexlify
@@ -4239,8 +4235,8 @@ def auto_install_ndk(build):
         for n in ndk:
             _install_ndk(n)
     else:
-        BuildException(_('Invalid ndk: entry in build: "{ndk}"')
-                       .format(ndk=str(ndk)))
+        raise BuildException(_('Invalid ndk: entry in build: "{ndk}"')
+                             .format(ndk=str(ndk)))
 
 
 def _install_ndk(ndk):
diff --git a/fdroidserver/gpgsign.py b/fdroidserver/gpgsign.py
index 6c8842bd..da845d4f 100644
--- a/fdroidserver/gpgsign.py
+++ b/fdroidserver/gpgsign.py
@@ -42,7 +42,6 @@ def status_update_json(signed):
 
 
 def main():
-
     global config, options
 
     # Parse command line...
diff --git a/fdroidserver/import_subcommand.py b/fdroidserver/import_subcommand.py
index 0c31f0c1..b8fb7093 100644
--- a/fdroidserver/import_subcommand.py
+++ b/fdroidserver/import_subcommand.py
@@ -183,7 +183,6 @@ def get_app_from_url(url):
 
 
 def main():
-
     global config, options
 
     # Parse command line...
diff --git a/fdroidserver/init.py b/fdroidserver/init.py
index 313dcc22..e87771cd 100644
--- a/fdroidserver/init.py
+++ b/fdroidserver/init.py
@@ -49,7 +49,6 @@ def disable_in_config(key, value):
 
 
 def main():
-
     global options, config
 
     # Parse command line...
diff --git a/fdroidserver/install.py b/fdroidserver/install.py
index 0f933121..37631519 100644
--- a/fdroidserver/install.py
+++ b/fdroidserver/install.py
@@ -44,7 +44,6 @@ def devices():
 
 
 def main():
-
     global options, config
 
     # Parse command line...
diff --git a/fdroidserver/lint.py b/fdroidserver/lint.py
index e8417510..bc165f30 100644
--- a/fdroidserver/lint.py
+++ b/fdroidserver/lint.py
@@ -697,7 +697,6 @@ def check_updates_ucm_http_aum_pattern(app):  # noqa: D403
 
 
 def main():
-
     global config, options
 
     # Parse command line...
@@ -754,7 +753,6 @@ def main():
 
         # only run yamllint when linting individual apps.
         if options.appid or options.force_yamllint:
-
             # run yamllint on app metadata
             ymlpath = Path('metadata') / (appid + '.yml')
             if ymlpath.is_file():
diff --git a/fdroidserver/nightly.py b/fdroidserver/nightly.py
index 045f5496..2d1c1ead 100644
--- a/fdroidserver/nightly.py
+++ b/fdroidserver/nightly.py
@@ -160,7 +160,6 @@ def get_repo_base_url(clone_url, repo_git_base, force_type=None):
 
 
 def main():
-
     parser = ArgumentParser()
     common.setup_global_opts(parser)
     parser.add_argument(
diff --git a/fdroidserver/readmeta.py b/fdroidserver/readmeta.py
index b45e9559..e129f0c8 100644
--- a/fdroidserver/readmeta.py
+++ b/fdroidserver/readmeta.py
@@ -24,7 +24,6 @@ options = None
 
 
 def main():
-
     parser = ArgumentParser()
     common.setup_global_opts(parser)
     metadata.add_metadata_arguments(parser)
diff --git a/fdroidserver/rewritemeta.py b/fdroidserver/rewritemeta.py
index 3a133c72..51e645d9 100644
--- a/fdroidserver/rewritemeta.py
+++ b/fdroidserver/rewritemeta.py
@@ -45,7 +45,6 @@ def proper_format(app):
 
 
 def main():
-
     global config, options
 
     parser = ArgumentParser()
diff --git a/fdroidserver/signindex.py b/fdroidserver/signindex.py
index 8610f654..ea34fd6c 100644
--- a/fdroidserver/signindex.py
+++ b/fdroidserver/signindex.py
@@ -175,7 +175,6 @@ def status_update_json(signed):
 
 
 def main():
-
     global config, options
 
     parser = ArgumentParser()
diff --git a/fdroidserver/update.py b/fdroidserver/update.py
index 222587a9..6168ecb8 100644
--- a/fdroidserver/update.py
+++ b/fdroidserver/update.py
@@ -2150,7 +2150,6 @@ start_timestamp = time.gmtime()
 
 
 def main():
-
     global config, options
 
     # Parse command line...
diff --git a/fdroidserver/verify.py b/fdroidserver/verify.py
index e12f72ea..765f23c9 100644
--- a/fdroidserver/verify.py
+++ b/fdroidserver/verify.py
@@ -146,7 +146,6 @@ def write_json_report(url, remote_apk, unsigned_apk, compare_result):
 
 
 def main():
-
     global options, config
 
     # Parse command line...
@@ -192,7 +191,6 @@ def main():
     vercodes = common.read_pkg_args(options.appid, True)
 
     for apkfile in sorted(glob.glob(os.path.join(unsigned_dir, '*.apk'))):
-
         apkfilename = os.path.basename(apkfile)
         url = 'https://f-droid.org/repo/' + apkfilename
         appid, vercode = common.publishednameinfo(apkfile)
@@ -205,7 +203,6 @@ def main():
         processed.add(appid)
 
         try:
-
             logging.info("Processing {apkfilename}".format(apkfilename=apkfilename))
 
             remote_apk = os.path.join(tmp_dir, apkfilename)
diff --git a/pyproject.toml b/pyproject.toml
index dd76d7c6..d351e8e3 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -52,6 +52,8 @@ confidence = ["HIGH", "INFERENCE"]
 
 # TODO many of these could be fixed if someone wants to spend the time
 disable = [
+  "broad-exception-caught",
+  "broad-exception-raised",
   "consider-iterating-dictionary",
   "consider-using-sys-exit",
   "invalid-name",
diff --git a/tests/build.TestCase b/tests/build.TestCase
index b6ceee10..197cf48b 100755
--- a/tests/build.TestCase
+++ b/tests/build.TestCase
@@ -442,7 +442,6 @@ class BuildTest(unittest.TestCase):
         self.assertEqual(0, count, "Shouldn't error on jar from extlib")
 
     def test_failed_verifies_are_not_in_unsigned(self):
-
         os.chdir(self.testdir)
         sdk_path = os.path.join(self.testdir, 'android-sdk')
         self.create_fake_android_home(sdk_path)
diff --git a/tests/deploy.TestCase b/tests/deploy.TestCase
index 70030e4d..a577ee9d 100755
--- a/tests/deploy.TestCase
+++ b/tests/deploy.TestCase
@@ -31,7 +31,6 @@ class DeployTest(unittest.TestCase):
         fdroidserver.deploy.config = {}
 
     def test_update_serverwebroot_make_cur_version_link(self):
-
         # setup parameters for this test run
         fdroidserver.deploy.options.no_chcksum = True
         fdroidserver.deploy.options.identity_file = None
@@ -123,7 +122,6 @@ class DeployTest(unittest.TestCase):
         self.assertEqual(call_iteration, 3, 'expected 3 invocations of subprocess.call')
 
     def test_update_serverwebroot_with_id_file(self):
-
         # setup parameters for this test run
         fdroidserver.deploy.options.no_chcksum = False
         fdroidserver.deploy.options.verbose = True
diff --git a/tests/lint.TestCase b/tests/lint.TestCase
index 07bd567d..6fbe76cf 100755
--- a/tests/lint.TestCase
+++ b/tests/lint.TestCase
@@ -171,7 +171,6 @@ class LintTest(unittest.TestCase):
         }
 
         for field, values in fields.items():
-
             for bad in values['bad']:
                 anywarns = False
                 app[field] = bad
diff --git a/tests/nightly.TestCase b/tests/nightly.TestCase
index e7f41a8a..9c861fcb 100755
--- a/tests/nightly.TestCase
+++ b/tests/nightly.TestCase
@@ -48,7 +48,6 @@ class Options:
 
 
 class NightlyTest(unittest.TestCase):
-
     basedir = Path(__file__).resolve().parent
     path = os.environ['PATH']
 
diff --git a/tests/rewritemeta.TestCase b/tests/rewritemeta.TestCase
index 7c245a8a..2cd397d2 100755
--- a/tests/rewritemeta.TestCase
+++ b/tests/rewritemeta.TestCase
@@ -32,7 +32,6 @@ class RewriteMetaTest(unittest.TestCase):
         os.chdir(self.basedir)
 
     def test_rewrite_scenario_trivial(self):
-
         sys.argv = ['rewritemeta', 'a', 'b']
 
         with tempfile.TemporaryDirectory() as tmpdir, TmpCwd(tmpdir):
diff --git a/tests/signindex.TestCase b/tests/signindex.TestCase
index 1961d0e1..28afa689 100755
--- a/tests/signindex.TestCase
+++ b/tests/signindex.TestCase
@@ -34,7 +34,6 @@ class Options:
 
 
 class SignindexTest(unittest.TestCase):
-
     basedir = Path(__file__).resolve().parent
 
     def setUp(self):
diff --git a/tests/verify.TestCase b/tests/verify.TestCase
index c62ea95d..774e24fa 100755
--- a/tests/verify.TestCase
+++ b/tests/verify.TestCase
@@ -48,7 +48,6 @@ TEST_APP_ENTRY = {
 
 
 class VerifyTest(unittest.TestCase):
-
     basedir = Path(__file__).resolve().parent
 
     def setUp(self):