manifest-external-assets (ODOO046)

Preview (since 0.16.2.2) · Related issues · View source

Derived from the odoo linter.

This rule is unstable and in preview. The --preview flag is required for use.

What it does

Checks for external URLs in the assets key of an Odoo module's __manifest__.py.

Why is this bad?

Assets loaded from a CDN can change or disappear out from under the module, and expose users to third-party outages and supply-chain risks. Assets should be distributed with the module's source code.

Example

{
    "assets": {
        "web.assets_backend": [
            "https://cdn.example.com/lib.js",
        ],
    },
}