Yeah ultimately the user doesn't install the dependencies, they install Evolution. So if there's a security issue, that's where they'll see it. There are also p

Yeah ultimately the user doesn't install the dependencies, they install Evolution. So if there's a security issue, that's where they'll see it. There are also potential mitigation for this, for instance scrubbing the HTML (which it seems Geary actually does, just not for this).