Comment 6 for bug 1770871

this looks ok from the packaging side.
It's a little bit odd that the package is orphaned in Debian, and now pulled into main.

assigning to the security team for a review (parsing external data)