Package: libvtk6 Severity: serious Version: 6.1.0+dfsg-3 VTK6 is using a convenient copy of jsoncpp. This is in violation of debian policy §4.13. https://www.debian.org/doc/debian-policy/ch-source.html#s-embeddedfiles