Package: elpa-elfeed-web Version: 3.1.0-1 Severity: serious Control: block -1 by 902083 Control: found -1 3.3.0-1
elfeed-web uses Foundation [1], AngularJS [2], and URI.js [3], loading them from various CDN sites in index.html: <link rel="stylesheet" href="//cdn.jsdelivr.net/foundation/4.3.1/css/foundation.min.css"/> <script src="//ajax.googleapis.com/ajax/libs/angularjs/1.0.7/angular.min.js"></script> <script src="//cdnjs.cloudflare.com/ajax/libs/URI.js/1.7.2/URI.min.js"></script> AngularJS is included in main, but Foundation and URI.js are not. This is probably a violation of Policy 2.2.1, which states that “None of the packages in the main archive area requires software outside of that area to function.” Ideally, Debian’s elfeed-web should Depend on packages containing Foundation, AngularJS, and URI.js, and it should be patched to load those resources from the same origin as index.html. There’s already an ITP for URI.js, which I’ve marked as a blocker for this bug. [1] https://foundation.zurb.com/ [2] https://angularjs.org/ [3] https://medialize.github.io/URI.js/