jackson3-dataformats-text 3.2.4-1

Package Information

Description	fast and powerful JSON library for Java -- YAML dataformat The Jackson Data Processor is a multi-purpose Java library for processing JSON. Jackson aims to be the best possible combination of fast, correct, lightweight, and ergonomic for developers. It offers three alternative methods for processing JSON: * Streaming API inspired by StAX * Tree Model * Data Binding converts JSON to and from POJOs In addition to the core library, there are numerous extension that provide additional functionality such as additional data formats beyond JSON, additional data types or JVM languages. This package contains an extension for reading and writing YAML encoded data.
Maintainer	Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Sponsor	ebourg@apache.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/java-team/jackson3-dataformats-text.git (browse)
Closes	#1149815
Tracker	https://tracker.debian.org/pkg/jackson3-dataformats-text
Uploaded	3 hours ago

New Package Report

.changes◂

Changed-By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Architecture	source all
Distribution	unstable
Date	Tue, 03 Nov 2026 00:19:10 +0100
Source	jackson3-dataformats-text
Version	3.2.4-1

Changelog◂

jackson3-dataformats-text (3.2.4-1) unstable; urgency=medium
 .
   * Team upload.
   * Cloned the package as jackson3-dataformats-text (Closes: #1149815)
   * New upstream release
     - Depend on libjackson3-core-java and libjackson3-databind-java
     - Depend on libsnakeyaml-engine-java instead of libyaml-snake-java
     - Updated the Maven rules
     - Build the tests with AssertJ
     - Set the language source/target level to Java 17
     - Build without the Java module descriptors
     - Updated debian/copyright
   * Excluded the docs directory from the source tarball
   * Removed the Provides/Breaks/Replaces on libjackson2-dataformat-yaml
   * Added an autopkgtest reading and writing YAML

.dsc◂

Package-List	libjackson3-dataformat-yaml-java deb java optional arch=all
Section	java
Priority	optional
Component	main

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: Jackson dataformats text
Source: https://github.com/FasterXML/jackson-dataformats-text
Upstream-Contact: FasterXML <info@fasterxml.com>
Files-Excluded: mvnw*
                .mvn/*
                docs

Files: *
Copyright: 2013-2017, FasterXML, LLC, Seattle, USA <info@fasterxml.com>
           2007-2026, Tatu Saloranta <tatu.saloranta@iki.fi>
License: Apache-2.0

Files: toml/src/main/jflex/tools/jackson/dataformat/toml/toml.jflex
       toml/src/test/java/tools/jackson/dataformat/toml/TomlParserTest.java
Copyright: 2007-2026, Tatu Saloranta <tatu.saloranta@iki.fi>
           Tom Preston-Werner
License: Apache-2.0 and MIT
Comment: The TOML grammar and parts of the test suite are adapted from the
 TOML project, as stated in toml/LICENSE.

Files: toml/src/main/jflex/skeleton-toml
Copyright: Gerwin Klein, Steve Rowe, Régis Décamps, Google LLC
           2007-2026, Tatu Saloranta <tatu.saloranta@iki.fi>
License: BSD-3-clause

Files: debian/*
Copyright: 2026, Emmanuel Bourg <ebourg@apache.org>
           2026, Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Apache-2.0

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
     http://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems the full text of the Apache License version 2.0
 can be found in the file /usr/share/common-licenses/Apache-2.0.

License: MIT
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
   * Redistributions of source code must retain the above copyright notice,
     this list of conditions and the following disclaimer.
   * Redistributions in binary form must reproduce the above copyright
     notice, this list of conditions and the following disclaimer in the
     documentation and/or other materials provided with the distribution.
   * Neither the names of the authors nor the names of JFlex contributors may
     be used to endorse or promote products derived from this software without
     specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
 LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 POSSIBILITY OF SUCH DAMAGE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 2 hours ago.

Report◂

DFSG NEW review for jackson3-dataformats-text version 3.2.4-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 1 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 2 found

Licensing

The tree is Apache-2.0 throughout, with two narrow exceptions that debian/copyright handles: the TOML grammar and the TOML-project test material (MIT, © Tom Preston-Werner) and the JFlex skeleton used by the TOML lexer (BSD-3-clause, © Gerwin Klein, Steve Rowe, Régis Décamps, Google LLC), both matched by their own Files: stanzas, with the full MIT and BSD texts included. debian/copyright is DEP-5, names every holder found in the tree (top-level LICENSE, the per-module META-INF/LICENSE and NOTICE files, toml/LICENSE), and points at /usr/share/common-licenses for Apache-2.0. No non-free wording, no unlicensed file and no third-party code embedded; the only binaries are oss-fuzz regression inputs and public sample datasets, all test data. The Files-Excluded paths are absent from the repacked orig tarball, as the changelog says of docs.

Packaging

A clean maven-debian-helper package: one binary (libjackson3-dataformat-yaml-java) built from the umbrella source, with debian/libjackson3-dataformat-yaml-java.poms listing the root and yaml poms and --ignore for csv/properties/toml, ${maven:Depends}/${misc:Depends} present at compat 13, a --usj-name that yields /usr/share/java/jackson3-dataformat-yaml.jar as the autopkgtest expects. Two DEP-3 quilt patches, both applied, both marked Forwarded: not-needed for stated Debian-only reasons; a functional autopkgtest that compiles against the installed jars and checks the reported version; changelog, Vcs-* and Standards-Version (4.7.4 against Policy 4.7.4.1) all in order. Build-Depends all exist with satisfying versions.

Issues

minor packaging 1. Files-Excluded is set but the version carries no repack suffix ◂

Files: debian/copyright, debian/changelog, debian/watch
Basis: found by the review tooling's own checks
Evidence: 3.2.4-1
Problem: debian/copyright has Files-Excluded, so uscan repacks the upstream tarball, but the version in debian/changelog does not say so with a suffix such as +dfsg or +ds, as is the convention for a tarball that differs from upstream's.
Fix: Add the suffix to the version, and Repacksuffix to debian/watch.

Verified ◂

Read all of debian/: control, copyright, rules, changelog, libjackson3-dataformat-yaml-java.poms, maven.ignoreRules, maven.properties, patches/series and both patches, tests/control and tests/yaml, source/format; debian/watch left alone as instructed.
Inventoried the tree module by module (csv, properties, toml, yaml) plus top-level files: 377 files, no jar, class, image, font or archive. yaml/src/main/java/.../PackageVersion.java.in is the template for the generated PackageVersion class; toml/src/main/jflex/tools/jackson/dataformat/toml/toml.jflex plus toml/src/main/jflex/skeleton-toml are the generator inputs for the JFlex lexer (and toml is not built).
Licence evidence: top-level LICENSE is the full Apache-2.0 text; each module's src/main/resources/META-INF/LICENSE grants Apache-2.0 and NOTICE reads Copyright 2007-, Tatu Saloranta; toml/LICENSE additionally carries the MIT text (© Tom Preston-Werner, TOML project) and the JFlex BSD-3-clause text with its holders.
Grepped the whole tree (gitignore false) for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU/LGPL, Mozilla Public, public domain, All rights reserved, adapted from/derived from and non-free wording (non-commercial, no modification, field of use, research only): the only notices are the ones debian/copyright records; no Java file carries a third-party header, and no non-free term occurs.
debian/copyright stanza match: the MIT stanza covers toml/src/main/jflex/tools/jackson/dataformat/toml/toml.jflex and toml/src/test/java/tools/jackson/dataformat/toml/TomlParserTest.java, the latter genuinely embedding the canonical TOML example at lines 108, 474-477 and 982-983; the BSD-3-clause stanza covers toml/src/main/jflex/skeleton-toml, which is the modified JFlex skeleton (// JACKSON: remove initializer...). Full MIT and BSD texts are in the file; Apache-2.0 points to /usr/share/common-licenses.
csv/src/test/resources/data/clusterfuzz-testcase-minimized-CSVFuzzer-499695465.csv (listed by the scan) is the oss-fuzz regression input read as a byte[] by CSVFuzz499695465Test; its unrecognised 'binary' content is a short line of fuzz garbage (su,,DDD,D ,U,D,D),D,D, ,U,,U),.U/...), not built code.
csv/src/test/resources/data/fuzz-50402.csv (listed by the scan) is the oss-fuzz input read by CSVFuzz50402Test; 138 KB of quoted dashes with stray bytes, i.e. fuzzer output, not generated or minified code. Neither CSV is installed: the csv pom is --ignore.
Same class of file elsewhere: yaml/src/test/resources/data/fuzz-65918.yaml (FuzzYAML_65918_Test) and toml/src/test/resources/clusterfuzz-testcase-minimized-TOMLFuzzer-{5068015447703552,6370486359031808,6542204348006400} (FuzzTomlReadTest/FuzzTomlRead57237Test) are oss-fuzz inputs.
csv/src/test/resources/data/story-100.csv is Hacker News story data with embedding vectors, used by ReadBracketedArray442Test; csv/samples/f_5500_2010_first9999.csv is the 6.4 MB file whose tail the scan did not read — US Department of Labor Form 5500 (EFAST2) public filings, used by the csv perf reader F5500Reader. Both are third-party factual data with no licence terms of their own, carry no code, and are not installed in any binary.
Orig tarball root (/review/jackson3-dataformats-text_3.2.4.orig.tar.xz) contains no docs/, .mvn/ or mvnw, matching Files-Excluded; the changelog states the docs directory was excluded and CLAUDE.md confirms ./mvnw exists upstream.
Build-Depends resolve in the archive (apt-cache): libjackson3-core-java 3.2.4-1, libjackson3-databind-java 3.2.4-2, libjackson2-annotations-java 2.22-1, libsnakeyaml-engine-java 2.7+ds-4, junit5 5.14.4-2, libassertj-core-java 3.26.3-2, libbuild-helper-maven-plugin-java 3.3.0-1, libreplacer-java 1.5.3-3.
mh_installjar(1): --usj-name is 'the name to use when installing the library in /usr/share/java when --java-lib is used', so the package installs jackson3-dataformat-yaml.jar — the name debian/tests/yaml puts on its classpath, and the same convention the family's other packages must use to avoid clashing with jackson 2 jars.
mh_patchpoms(1)/mh_installpoms(1): -k --keep-pom-version 'convert[s] all other versions in dependencies and plugins', so the yaml pom's snakeyaml-engine 3.0.1 is turned into Debian's 2.7 without a debian/maven.rules; the version pin is therefore not a build problem.
Policy 4.7.4.1 is the reviewing system's Policy (policy tool), so Standards-Version 4.7.4 is current; debhelper-compat 13 with ${maven:Depends}, ${misc:Depends} in Depends is correct at that level.
Both patches have DEP-3 Description/Author/Forwarded headers, are applied, and touch only the yaml module (csv/properties/toml have their own module-info.java, and those modules are not built).
uscan found the packaged version as the newest upstream release (upstream 3.2.4, packaged 3.2.4).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

Could not execute the autopkgtest or inspect the installed jackson3-* jars: the jackson3 packages are not installed on the reviewing system, so the classpath entries /usr/share/java/jackson3-{core,databind}.jar could only be inferred from the naming convention this package itself uses.
Whether upstream 3.2.4 really shipped docs/, .mvn/ and mvnw: the orig tarball here is already the repacked one, so only their absence is visible (the changelog and CLAUDE.md indicate they existed).

Proposed changes ◂

None.

Uploader's response to the LLM review

No change planned. Please, accept the upload.

The rationale is this:

Files-Excluded only drops the Maven wrapper and docs (nothing non-free), and the Jackson 3 packages already accepted (jackson3-core 3.2.4-1, jackson3-databind 3.2.4-2) use the same convention without a repack suffix.

— Juan Manuel Méndez Rey (mendezr), 2 hours ago

Back to Dashboard | View all reviews for this package