DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: jackson-dataformats-text 2.18.11-1

Package Information

Descriptionfast and powerful JSON library for Java -- YAML dataformat

The Jackson Data Processor is a multi-purpose Java library for processing JSON. Jackson aims to be the best possible combination of fast, correct, lightweight, and ergonomic for developers. It offers three alternative methods for processing JSON:

* Streaming API inspired by StAX * Tree Model * Data Binding converts JSON to and from POJOs

In addition to the core library, there are numerous extension that provide additional functionality such as additional data formats beyond JSON, additional data types or JVM languages.

This package contains an extension for reading and writing YAML encoded data.

MaintainerDebian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed ByEmmanuel Bourg <ebourg@apache.org>
Sponsorebourg@apache.org
Distributionunstable
Architectureall
VCSgit: https://salsa.debian.org/java-team/jackson-dataformats-text.git (browse)
Closes#1151003
Blocked Bugs#1151020 (normal)
Trackerhttps://tracker.debian.org/pkg/jackson-dataformats-text
Uploaded16 days ago

New Package Report

.changes◂
Sourcejackson-dataformats-text
Version2.18.11-1
Changed-ByEmmanuel Bourg <ebourg@apache.org>
Architecturesource all
Distributionunstable
DateThu, 22 Oct 2026 13:45:56 +0200
Changelog◂
jackson-dataformats-text (2.18.11-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1151003)
.dsc◂
Sectionjava
Priorityoptional
Componentmain
Package-Listlibjackson2-dataformat-yaml-java deb java optional arch=all
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: Jackson dataformats text
Source: https://github.com/FasterXML/jackson-dataformats-text
Upstream-Contact: FasterXML <info@fasterxml.com>
Files-Excluded: mvnw*
                .mvn/*

Files: *
Copyright: 2013-2017, FasterXML, LLC, Seattle, USA <info@fasterxml.com>
           2007-, Tatu Saloranta <tatu.saloranta@iki.fi>
License: Apache-2.0

Files: toml/src/main/jflex/com/fasterxml/jackson/dataformat/toml/toml.jflex
       toml/src/test/java/com/fasterxml/jackson/dataformat/toml/TomlParserTest.java
Copyright: 2020-2021, FasterXML, LLC, Seattle, USA <info@fasterxml.com>
           Tom Preston-Werner
License: Apache-2.0 and MIT
Comment: The TOML grammar and parts of the test suite are adapted from the
 TOML project, as stated in toml/LICENSE.

Files: toml/src/main/jflex/skeleton-toml
Copyright: Gerwin Klein, Steve Rowe, Regis Decamps, Google LLC
License: BSD-3-clause

Files: debian/*
Copyright: 2026, Emmanuel Bourg <ebourg@apache.org>
License: Apache-2.0

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
     http://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems the full text of the Apache License version 2.0
 can be found in the file /usr/share/common-licenses/Apache-2.0.

License: MIT
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
   * Redistributions of source code must retain the above copyright notice,
     this list of conditions and the following disclaimer.
   * Redistributions in binary form must reproduce the above copyright
     notice, this list of conditions and the following disclaimer in the
     documentation and/or other materials provided with the distribution.
   * Neither the names of the authors nor the names of JFlex contributors may
     be used to endorse or promote products derived from this software without
     specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
 LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 POSSIBILITY OF SUCH DAMAGE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 16 days ago.

Report◂

DFSG NEW review for jackson-dataformats-text version 2.18.11-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: Yes
  • Packaging is of good quality: Yes
  • Issues: 0 blocker, 0 important, 2 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable
  • Scan before the review: 1 found

Licensing

DFSG-compliant: the whole tree is Apache-2.0, with the TOML grammar/test files additionally MIT (Tom Preston-Werner) and the JFlex skeleton-toml BSD-3-clause, all free. debian/copyright is DEP-5 machine-readable and covers every file with the correct licenses and full texts (MIT and BSD-3-clause reproduced, Apache-2.0 via /usr/share/common-licenses), with stanzas for the TOML and JFlex derivations correctly mapped. One minor inaccuracy: the holder 'FasterXML.com' (2012) declared in the properties services file is not named in any Copyright field; reported as a minor issue.

Packaging

Standard, clean Debian Java packaging: debhelper compat 13 with a plain dh $@ rules file, maven-debian-helper with .poms (yaml built and installed, csv/properties/toml ignored for this first upload), every Build-Depends exists in the archive at satisfiable versions, Standards-Version 4.7.4 matches current Policy 4.7.4.1, Vcs-* on salsa, and the rename from the old libjackson2-dataformat-yaml is handled properly with Provides + Breaks/Replaces (<< 2.18.11~). No faults found that a sponsor would require fixing.

Issues

minor licensing 1. Copyright holder 'FasterXML.com' (2012) not named in debian/copyright ◂
  • Files: properties/src/main/resources/META-INF/services/com.fasterxml.jackson.core.JsonFactory:1, debian/copyright
  • Basis: checked, in the package or with a reference tool
  • Evidence: The file's own notice reads # Copyright 2012 FasterXML.com; debian/copyright's Files: * stanza only names 2013-2017, FasterXML, LLC, Seattle, USA <info@fasterxml.com> and 2007-, Tatu Saloranta <tatu.saloranta@iki.fi>.
  • Problem: The holder string and year in this file's notice (FasterXML.com, 2012) are not represented in any Copyright: field, so even though the licence (Apache-2.0) is correctly stated, debian/copyright does not name every copyright holder the files declare. Minor because 'FasterXML.com' is almost certainly the same FasterXML entity under its domain-style name.
  • Fix: Add the holder to the Files: * Copyright list (or a dedicated stanza), e.g. 2012, FasterXML.com.
minor packaging 2. Files-Excluded is set but the version carries no repack suffix ◂
  • Files: debian/copyright, debian/changelog, debian/watch
  • Basis: found by the review tooling's own checks
  • Evidence: 2.18.11-1
  • Problem: debian/copyright has Files-Excluded, so uscan repacks the upstream tarball, but the version in debian/changelog does not say so with a suffix such as +dfsg or +ds, as is the convention for a tarball that differs from upstream's.
  • Fix: Add the suffix to the version, and Repacksuffix to debian/watch.
Verified ◂
  • Read debian/copyright in full: DEP-5 format 1.0, header with Upstream-Name/Source/Upstream-Contact, Files-Excluded mvnw* and .mvn/*, Files: * (Apache-2.0), Files: stanza for toml.jflex/TomlParserTest.java (Apache-2.0 and MIT, Tom Preston-Werner), Files: stanza for skeleton-toml (BSD-3-clause, Gerwin Klein, Steve Rowe, Regis Decamps, Google LLC), Files: debian/* (Apache-2.0, Emmanuel Bourg 2026). MIT and BSD-3-clause texts are reproduced in full; Apache-2.0 points to /usr/share/common-licenses. No proposed_copyright needed (already machine-readable).
  • Licence evidence matched across the tree: top-level LICENSE is Apache-2.0; csv/properties/yaml/toml each ship src/main/resources/META-INF/{LICENSE,NOTICE} (NOTICE: Copyright 2007-, Tatu Saloranta); toml/LICENSE documents Apache-2.0 + MIT (TOML grammar, Tom Preston-Werner) + BSD-3-clause (JFlex, holders as above), consistent with the dedicated copyright stanzas.
  • Java sources carry no per-file licence headers (grep for Copyright/(C)/SPDX/licence terms across all four modules' src found no other holders or licence variants); licensing rests on the NOTICE/LICENSE files and the top-level LICENSE.
  • yaml/.../snakeyaml/error/{Mark,MarkedYAMLException,YAMLException}.java are Jackson's own thin deprecated compatibility wrappers for formerly shaded SnakeYAML types (read them), Apache-2.0, not vendored SnakeYAML requiring separate attribution.
  • docs/javadoc (generated javadoc for csv 2.9-2.18 and yaml/properties 2.9): generated documentation whose source (the Java files + comments) is present in the tree; the Copyright (c) 2019 FasterXML. All rights reserved. strings are only the standard javadoc legalCopy footer, not a licence restriction; not installed by the packaging.
  • docs/javadoc//resources/.gif (background.gif, tab.gif, titlebar.gif, titlebar_end.gif): standard javadoc-doclet-generated images, Apache-2.0 by origin; noted by name only as prescribed.
  • csv/src/test/resources/data/fuzz-50402.csv (prescan binary item): 138 KB CSV fuzz-corpus test fixture that is not valid UTF-8; free Apache-2.0 test data, never installed; its CSV text form is its own preferred form, no separate source required.
  • csv/samples/f_5500_2010_first9999.csv: 6.4 MB sample CSV (public US DOL Form 5500 data); the prescan's one >4 MiB file, sampled rather than read to EOF; sample/test data under the project licence.
  • Files-Excluded mvnw*/.mvn/*: no such files anywhere in the unpacked tree and none in the .orig.tar.xz member listing either, so the stanza excludes nothing shipped in the tarball (a harmless no-op from upstream's release tarball), and the tarball therefore carries no +ds suffix.
  • Packaging files all read: control, rules (dh $@), changelog (2.18.11-1, initial release, Closes: #1151003), source/format 3.0 (quilt), maven.rules/publishedRules/ignoreRules/properties, libjackson2-dataformat-yaml-java.poms (yaml --java-lib; csv/properties/toml --ignore). Build-Depends/tests targets: no override_dh_auto_test or nocheck concerns at all with compat 13.
  • Every Build-Depends exists in the archive at a satisfiable version (apt-cache): libjackson2-core-java/annotations/databind 2.18.11-1, libyaml-snake-java 2.5+ds-1 (>= 2.5 ok), junit4, libreplacer-java, libmaven-bundle-plugin-java, libbuild-helper-maven-plugin-java, maven-debian-helper.
  • Standards-Version 4.7.4 is current against Policy 4.7.4.1 (policy tool); the rename libjackson2-dataformat-yaml (old 2.8.11-5, still in the lists) -> libjackson2-dataformat-yaml-java is done with Provides/Replaces/Breaks (<< 2.18.11~), the standard Java-team rename pattern.
  • Sampled Java source headers (YAMLFactory, LRUMap, toml.jflex, skeleton-toml) and ran tree-wide greps for licence/copyright/SDPX terms; coverage is representative rather than per-file for all 1741 files.
  • uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 2.22.4, packaged 2.18.11), which is not a fault of the package.
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).
Not confirmed ◂
  • No build was run (read-only environment); no specific build or test failure is suspected since all declared Build-Depends exist in the archive and the maven helper files follow the standard pattern.
Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 16 days ago.

Review Information

accepted — allocated to awm 16 days ago, started 16 days ago, completed 16 days ago.

Final Comment

Other Reviews of this Package

VersionHashAllocatedCompletedReviewerStatusDetails
2.18.11-2 81526b4f… 2026-10-22 11:36 2026-10-22 11:36 dfsg-uploader rejected VIEW
2.18.11-1 41ab87cf… 2026-10-20 07:28 2026-10-20 07:28 dfsg-uploader rejected VIEW

Back to Dashboard | View all reviews for this package