manifest-external-assets (W8162)

An asset in the manifest is loaded from an external URL.

What it does

Reports entries in the manifest assets that point to an external URL instead of a file in the module.

Why is this bad?

Assets from a CDN break offline and air-gapped installations, change without notice and give a third party a way to inject code into every Odoo page. See the risks of public CDNs.

Example

{
    "assets": {
        "web.assets_backend": ["https://cdn.example.com/chart.js"],
    },
}

Use instead: ship the file in the module, for example acme_chart/static/lib/chart.js.