DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: jackson-dataformats-text 2.18.11-2

Package Information

Descriptionfast and powerful JSON library for Java -- YAML dataformat

The Jackson Data Processor is a multi-purpose Java library for processing JSON. Jackson aims to be the best possible combination of fast, correct, lightweight, and ergonomic for developers. It offers three alternative methods for processing JSON:

* Streaming API inspired by StAX * Tree Model * Data Binding converts JSON to and from POJOs

In addition to the core library, there are numerous extension that provide additional functionality such as additional data formats beyond JSON, additional data types or JVM languages.

This package contains an extension for reading and writing YAML encoded data.

MaintainerDebian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed ByEmmanuel Bourg <ebourg@apache.org>
Sponsorebourg@apache.org
Distributionunstable
Architectureall
VCSgit: https://salsa.debian.org/java-team/jackson-dataformats-text.git (browse)
Trackerhttps://tracker.debian.org/pkg/jackson-dataformats-text
Uploaded17 days ago

New Package Report

.changes◂
DateTue, 20 Oct 2026 19:25:49 +0200
Sourcejackson-dataformats-text
Version2.18.11-2
Changed-ByEmmanuel Bourg <ebourg@apache.org>
Architecturesource all
Distributionunstable
Changelog◂
jackson-dataformats-text (2.18.11-2) unstable; urgency=medium
 .
   * Added the missing info in debian/copyright
.dsc◂
Package-Listlibjackson2-dataformat-yaml-java deb java optional arch=all
Sectionjava
Priorityoptional
Componentmain
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: Jackson dataformats text
Source: https://github.com/FasterXML/jackson-dataformats-text
Upstream-Contact: FasterXML <info@fasterxml.com>
Files-Excluded: mvnw*
                .mvn/*

Files: *
Copyright: 2013-2017, FasterXML, LLC, Seattle, USA <info@fasterxml.com>
           2007-, Tatu Saloranta <tatu.saloranta@iki.fi>
License: Apache-2.0

Files: toml/src/main/jflex/com/fasterxml/jackson/dataformat/toml/toml.jflex
       toml/src/test/java/com/fasterxml/jackson/dataformat/toml/TomlParserTest.java
Copyright: 2020-2021, FasterXML, LLC, Seattle, USA <info@fasterxml.com>
           Tom Preston-Werner
License: Apache-2.0 and MIT
Comment: The TOML grammar and parts of the test suite are adapted from the
 TOML project, as stated in toml/LICENSE.

Files: toml/src/main/jflex/skeleton-toml
Copyright: Gerwin Klein, Steve Rowe, Regis Decamps, Google LLC
License: BSD-3-clause

Files: debian/*
Copyright: 2026, Emmanuel Bourg <ebourg@apache.org>
License: Apache-2.0

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
     http://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems the full text of the Apache License version 2.0
 can be found in the file /usr/share/common-licenses/Apache-2.0.

License: MIT
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
   * Redistributions of source code must retain the above copyright notice,
     this list of conditions and the following disclaimer.
   * Redistributions in binary form must reproduce the above copyright
     notice, this list of conditions and the following disclaimer in the
     documentation and/or other materials provided with the distribution.
   * Neither the names of the authors nor the names of JFlex contributors may
     be used to endorse or promote products derived from this software without
     specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
 LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 POSSIBILITY OF SUCH DAMAGE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 17 days ago.

Report◂

DFSG NEW review for jackson-dataformats-text version 2.18.11-2

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: Yes
  • Packaging is of good quality: Yes
  • Issues: 0 blocker, 0 important, 2 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable
  • Scan before the review: 1 found

Licensing

The source is entirely free and DFSG-compliant. Almost all files fall under the Files: * catch-all, licensed Apache-2.0 (Jackson's standard licence, matching the LICENSE/NOTICE files in each module's META-INF and the root LICENSE). The toml module's jflex grammar and test file are correctly singled out as Apache-2.0 and MIT (adapted from the TOML project, per toml/LICENSE), and the JFlex skeleton as BSD-3-clause. The Files-Excluded: mvnw* .mvn/* repacking directives are honoured (no such files remain in the tree). No minified, compiled or non-source artifacts beyond test fixtures: csv/.../fuzz-50402.csv, the toml clusterfuzz testcase files and the docs/javadoc HTML are generated/test data whose Java sources are present. The only inaccuracy is that the properties module's services file carries 'Copyright 2012 FasterXML.com', a variant of the entity named in Files: * (FasterXML, LLC), which is not literally represented.

Packaging

Clean, conventional Debian Java packaging: debhelper-compat 13 with a simple dh $@ rules file, maven-debian-helper Build-Depends, and maven.rules/publishedRules that build only the yaml module (csv/properties/toml are marked --ignore in the .poms file). Standards-Version 4.7.4 matches current Policy 4.7.4.1. The binary package libjackson2-dataformat-yaml-java correctly renames the standalone libjackson2-dataformat-yaml (2.8.11) with Provides/Replaces/Breaks; the renamed package is not yet in the archive, so the Provides is not a fault. Changelog documents the initial release with bug closure and a follow-up fixing debian/copyright. No maintainer scripts, tests or policy violations present.

Issues

minor licensing 1. Copyright holder 'FasterXML.com' not named in debian/copyright ◂
  • Files: properties/src/main/resources/META-INF/services/com.fasterxml.jackson.core.JsonFactory (line 1); debian/copyright Files: * stanza
  • Basis: checked, in the package or with a reference tool
  • Evidence: File header: # Copyright 2012 FasterXML.com; debian/copyright Files: * names only FasterXML, LLC, Seattle, USA and Tatu Saloranta.
  • Problem: The Files: * catch-all correctly licenses this file (Apache-2.0) but does not name the holder in its own header, 'FasterXML.com'. It is the same company as FasterXML, LLC under an older name, so this is cosmetic, but the holder shown in the file notice is not represented.
  • Fix: Add 'FasterXML.com' to the Copyright line of the Files: * stanza (or a small dedicated stanza for the properties services files), e.g. Copyright: 2013-2017, FasterXML, LLC; 2012 FasterXML.com.
minor packaging 2. Files-Excluded is set but the version carries no repack suffix ◂
  • Files: debian/copyright, debian/changelog, debian/watch
  • Basis: found by the review tooling's own checks
  • Evidence: 2.18.11-2
  • Problem: debian/copyright has Files-Excluded, so uscan repacks the upstream tarball, but the version in debian/changelog does not say so with a suffix such as +dfsg or +ds, as is the convention for a tarball that differs from upstream's.
  • Fix: Add the suffix to the version, and Repacksuffix to debian/watch.
Verified ◂
  • debian/copyright is DEP-5 machine-readable with the correct Format: URL; all Files/License stanzas verified against on-tree LICENSE/NOTICE files and licence bodies (Apache-2.0, MIT, BSD-3-clause).
  • Files-Excluded (mvnw*, .mvn/*) are absent from the tree; the repacked tarball honours them.
  • No holder-vs-file mismatch beyond the FasterXML.com naming variant above; sampled main/test Java sources carry no per-file copyright headers and rely on the module LICENSE/NOTICE, correctly captured by Files: *.
  • csv/src/test/resources/data/fuzz-50402.csv is binary test input read by FuzzCSVReadTest (readResource("/data/fuzz-50402.csv")); not shipped functionality, no DFSG concern.
  • toml test resources clusterfuzz-testcase-minimized-* are fuzz regression test data.
  • docs/javadoc/csv/2.10/ HTML is generated javadoc whose Java sources are present in the tree; covered by Files: * Apache-2.0.
  • Packaging: debhelper-compat 13, dh $@, Standards-Version 4.7.4 (valid for Policy 4.7.4.1), build deps exist (apt-cache), ${maven:Depends}/${misc:Depends} present, rename Provides/Replaces/Breaks correct.
  • toml/LICENSE is a third-party licence file (TOML MIT + JFlex BSD) applied to the grammar/skeleton; matches the dedicated debian/copyright stanzas.
  • uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 2.22.4, packaged 2.18.11), which is not a fault of the package.
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).
Not confirmed ◂

None.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader rejected this upload in response to the review.

Review Information

rejected — allocated to dfsg-uploader 16 days ago, started 16 days ago, completed 16 days ago.

Final Comment

The uploader rejected this upload in response to the automated (LLM) review of it, so that they can fix the problems it found and upload again.

Other Reviews of this Package

VersionHashAllocatedCompletedReviewerStatusDetails
2.18.11-1 41ab87cf… 2026-10-20 07:28 2026-10-20 07:28 dfsg-uploader rejected VIEW
2.18.11-1 1b0289f8… 2026-10-23 02:16 2026-10-23 02:17 awm accepted VIEW

Back to Dashboard | View all reviews for this package