Review: monaco-editor-core 0.47.0+ds-1

Package Information

Description	core of the Monaco editor Monaco is the code editor that ships with VS Code; monaco-editor-core is its engine: the part of VS Code's src/vs tree that has been shaken down to the standalone editor, without the workbench and without the language servers. The monaco-editor package is the wrapper that adds the language workers, and is what applications normally depend on. The engine is shipped as an ES module tree, so it can be served to a browser as static files as well as pulled apart by a bundler. Node.js is an event-based server-side JavaScript engine.
Maintainer	Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed By	Emfox Zhou <emfox@debian.org>
Sponsor	emfox@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/js-team/monaco-editor-core.git (browse)
Closes	#1150312
Tracker	https://tracker.debian.org/pkg/monaco-editor-core
Uploaded	13 days ago

New Package Report

.changes◂

Distribution	unstable
Date	Sun, 25 Oct 2026 21:30:00 +0800
Source	monaco-editor-core
Version	0.47.0+ds-1
Changed-By	Emfox Zhou <emfox@debian.org>
Architecture	source all

Changelog◂

monaco-editor-core (0.47.0+ds-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1150312)

.dsc◂

Section	javascript
Priority	optional
Component	main
Package-List	libjs-monaco-editor-core deb javascript optional arch=all node-monaco-editor-core deb javascript optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: monaco-editor-core
Source: https://github.com/microsoft/vscode

Files: *
Copyright: 2016 - present Microsoft Corporation
License: Expat

Files: src/vs/base/browser/dompurify/*
Copyright: 2015 Mario Heiderich
License: Apache-2.0

Files: src/vs/base/common/marked/*
Copyright: 2011-2014 Christopher Jeffrey
           2018 - present MarkedJS
License: Expat

Files: src/vs/base/common/semver/semver.js
Copyright: 2011-2020 Isaac Z. Schlueter and Contributors
License: ISC

Files: src/vs/base/common/path.ts
 src/vs/base/test/common/path.test.ts
Copyright: Joyent, Inc. and other Node contributors
License: Expat

Files: debian/*
Copyright: 2026 Emfox Zhou <emfox@debian.org>
License: Expat

Files: debian/build-modules/@types/*
Copyright: Microsoft Corporation
License: Expat

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

License: ISC
 Permission to use, copy, modify, and/or distribute this software for any
 purpose with or without fee is hereby granted, provided that the above
 copyright notice and this permission notice appear in all copies.
 .
 THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
 REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
 AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
 INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
 LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
 OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 PERFORMANCE OF THIS SOFTWARE.

License: Apache-2.0
 On Debian systems, the complete text of the Apache License 2.0 can be found
 in /usr/share/common-licenses/Apache-2.0.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 13 days ago.

Report◂

DFSG NEW review for monaco-editor-core version 0.47.0+ds-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 2 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 3 found

Licensing

All code in the tree is DFSG-free: Microsoft's own code under MIT/Expat (Files: *), plus vendored third-party code that is each correctly singled out — the Node.js path library (Expat, Joyent), marked (Expat), DOMPurify (Apache-2.0/MPL-2.0 dual) and node-semver (ISC). debian/copyright is DEP-5 machine-readable, names the right holders for every vendored component, and includes the full text of every permissive licence (Expat, ISC) with Apache-2.0 pointed at /usr/share/common-licenses. Two minor imprecisions remain, reported below: one minified vendored bundle (semver.js) shipped without its preferred source, and the vendored DefinitelyTyped .d.ts files being attributed to the wrong holders/licence.

Packaging

The packaging is clean and careful: correct Build-Depends (all resolve in the archive, node-typescript 6.0.3 satisfies >= 6.0.0), a sensible two-binary split (node- and libjs-), debhelper compat 14 with a small, well-commented override of auto_build/auto_install, a single DEP-3 patch with clear purpose, a real autopkgtest exercising the installed tree, and thorough README.source/README.Debian documentation of the non-trivial repack and build. No policy violations, broken upgrade paths, or missing dependencies were found.

Issues

minor licensing 1. src/vs/base/common/semver/semver.js is a minified vendored node-semver bundle shipped without its preferred form for modification ◂

Files: src/vs/base/common/semver/semver.js, src/vs/base/common/semver/cgmanifest.json, debian/copyright
Basis: checked, in the package or with a reference tool
Evidence: semver.js header: Copyright (c) Isaac Z. Schlueter and Contributors, followed by !function(e,r){...} single-line minified UMD; cgmanifest.json: "license": "The ISC License", "version": "5.5.0" (node-semver).
Problem: The file is a webpack-bundled and minified UMD build of node-semver 5.5.0, i.e. a built file whose source (the preferred form for modification) is not in the package. node-semver is already in Debian, so this is also an embedded convenience copy. The maintainer excluded the equivalent prebuilt bundles (dompurify.js, marked.js) and replaced them with Debian packages at build time, but semver.js is left minified and copied into the shipped tree unchanged.
Fix: Replace the vendored minified bundle with Debian's node-semver at shake time as done for dompurify/marked, or, if the module format/version forces keeping it, document in README.source why node-semver cannot be used and point to the exact upstream source commit (already in cgmanifest.json).

minor licensing 2. dompurify/* and marked/* stanzas attribute the vendored DefinitelyTyped .d.ts files (and cgmanifest.json) to the wrong holders and licence ◂

Files: src/vs/base/browser/dompurify/dompurify.d.ts, src/vs/base/common/marked/marked.d.ts, src/vs/base/browser/dompurify/cgmanifest.json, src/vs/base/common/marked/cgmanifest.json, debian/copyright
Basis: checked, in the package or with a reference tool
Evidence: dompurify.d.ts opens // Type definitions for DOM Purify 3.0 / Definitions by: Dave Taylor ... Samira Bazuzi ... / Definitions: https://github.com/DefinitelyTyped/DefinitelyTyped; marked.d.ts likewise lists Definitions by: William Orr ... BendingBender .... debian/copyright declares Files: src/vs/base/browser/dompurify/* with Copyright: 2015 Mario Heiderich / License: Apache-2.0, and Files: src/vs/base/common/marked/* with Copyright: 2011-2014 Christopher Jeffrey / 2018 - present MarkedJS / License: Expat.
Problem: The .d.ts files are type declarations taken from DefinitelyTyped (MIT licensed, authored by the named 'Definitions by' contributors, not Mario Heiderich or the marked authors), and the cgmanifest.json files are Microsoft-authored. Because the stanza patterns are directory-wide (*), these files are attributed to the wrong entity; dompurify.d.ts is additionally declared Apache-2.0 when it is actually an MIT/Expat DefinitelyTyped file. The library-authored code the stanzas describe (dompurify.js, marked.js) was itself excluded from the orig tarball.
Fix: Narrow the two stanzas to the files they actually describe (the *.license.txt files), and let the DefinitelyTyped .d.ts files and cgmanifest.json fall under Files: * (Microsoft, Expat), or add explicit stanzas for them with the correct holders and Expat licence.

Verified ◂

Scanned 2021 files; the only non-Microsoft copyright notices are those accounted for in debian/copyright: Joyent/Node (path.ts, path.test.ts), Christopher Jeffrey/MarkedJS (marked), Mario Heiderich (DOMPurify), Isaac Z. Schlueter (semver.js).
src/vs/base/test/common/filters.perf.data.js is not minified code but a single-line test-data module (define(function() { return { data: [...] } })) carrying a Microsoft MIT header; it lives under test/ and is not shipped in a binary package.
src/vs/base/test/node/zip/fixtures/extract.zip is a test fixture for the zip module's tests, not shipped in a binary package.
The prebuilt bundles dompurify.js and marked.js, and codicon.ttf, are correctly absent from the source tree (only the .d.ts/.license.txt/cgmanifest.json and the CSS remain); get-orig-source removes them and they are substituted from node-dompurify/node-marked/fonts-codicons at build time.
All Build-Depends resolve in the archive (node-typescript 6.0.3, node-marked, node-dompurify, node-ansi-colors, node-fancy-log, fonts-codicons); node-semver also exists in Debian.
Third-party licence texts (marked.license.txt, dompurify.license.txt) and build/monaco/LICENSE are present and consistent with debian/copyright.
uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 0.57.0, packaged 0.47.0+ds), which is not a fault of the package.
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

The exact installed path of codicon.ttf within fonts-codicons (referenced as /usr/share/fonts/truetype/codicons/codicon.ttf by shake.cjs and the .links file) could not be confirmed from the package lists; a wrong path would fail the build and be caught by the build daemons, so it is not reported as an issue.
debian/watch looks at github.com/microsoft/monaco-editor, but the Source field of debian/copyright names github.com/microsoft/vscode. Whether these are the same upstream was not checked.
debian/watch looks at github.com/microsoft/monaco-editor, but Repository in debian/upstream/metadata names github.com/microsoft/vscode. Whether these are the same upstream was not checked.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 13 days ago.

Review Information

accepted — allocated to awm 12 days ago, started 12 days ago, completed 12 days ago.

Final Comment

Hi,

The LLM has identified some licensing issues which need a little cleanup. Please address that in your next upload.

Thanks!

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
0.57.0+ds-1	5793ecc3…	2026-10-25 12:14	2026-10-25 12:14	dfsg-uploader	rejected	VIEW

Back to Dashboard | View all reviews for this package