The PCI DSS only requires encryption to protect cardholder data:
Use strong cryptography and security protocols (for example, SSL/TLS, IPSEC,
SSH, etc.) to safeguard sensitive cardholder data during transmission over open, public networks.
Incidental page content which does not involve cardholder data does not require that level of protection. Of course, if your cart checkout (which must be secured as that's where card data gets entered) includes an unsecured http:// image, most browsers will complain, so you'll generally want to secure even the images and other content there.
If you're using a third party js library as a payment application, then PCI compliance is an issue - probably just making sure that it's PA-DSS compliant. However, if you're using a third party js to make your page look pretty, and it's not handling card data or impacting card data communication streams in any way, it won't impact compliance.
Updated to respond to @cchamberlain comment:
I believe that third-party libraries like Angular would fall under DSS (version 3.1 quoted here) section 6.2:
6.2 Ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor supplied security
patches. Install critical security patches within one month of
Contrast this to "bespoke or custom software developed by a third party" in section 6.3:
6.3 Develop internal and external software applications (including web-based administrative access to applications) securely, as follows:
- In accordance with PCI DSS (for example, secure authentication and
- Based on industry standards and/or best practices.
- Incorporating information security throughout the software-development
Note: this applies to all software developed internally as well as bespoke or custom software developed by a third party.
So, if it's a software product for general distribution, it's assumed not to be malicious and you need to keep it up-to-date and react to security advisories. But if someone develops custom code for you, you have to treat it with equivalent levels of scrutiny to your own code.
I think this boils down to "trust that the owners of the library do not have ill intent" for something like Angular. You're still responsible if they do something inappropriate, of course.