node-cmdk 1.1.1-1

Package Information

Description	fast, composable, unstyled command menu React component cmdk is a high-performance, accessible, and fully customizable command menu component for React applications. It provides quick keyboard navigation, fuzzy searching, and flexible item composition without imposing any default styles. This package provides the cmdk command menu library for Node.js environments.
Maintainer	Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed By	Andrew Lee (李健秋) <ajqlee@debian.org>
Sponsor	ajqlee@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/js-team/node-cmdk.git (browse)
Closes	#1151619
Tracker	https://tracker.debian.org/pkg/node-cmdk
Uploaded	1 hour ago

New Package Report

.changes◂

Version	1.1.1-1
Changed-By	Andrew Lee (李健秋) <ajqlee@debian.org>
Architecture	source all
Distribution	unstable
Date	Thu, 22 Oct 2026 11:04:44 +0200
Source	node-cmdk

Changelog◂

node-cmdk (1.1.1-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1151619)

.dsc◂

Priority	optional
Component	main
Package-List	node-cmdk deb javascript optional arch=all
Section	javascript

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: cmdk
Upstream-Contact: https://github.com/dip/cmdk/issues
Source: https://github.com/pacocoursey/cmdk

Files: *
Copyright: 2022 Paco Coursey
License: Expat

Files: debian/*
Copyright: Andrew Lee (李健秋) <ajqlee@debian.org>
License: Expat

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 1 blocker, 2 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 0 hours ago.

Report◂

DFSG NEW review for node-cmdk version 1.1.1-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: No
Issues: 1 blocker, 2 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The code is MIT/Expat and debian/copyright is a well-formed DEP-5 file that matches LICENSE.md, but Files: * claims every file in the source is Paco Coursey's Expat work while the tree also ships the third-party Inter font (website/public/inter-var-latin.woff2), for which no copyright holder or licence is given. That is an inaccurate copyright file and a missing verbatim licence (Policy 12.5), so it must be fixed before acceptance.

Packaging

The dh usage, source format, changelog, tests and Vcs fields are fine, but two functional defects make the binary unusable or incomplete as shipped: Depends: ${nodejs:Depends} names a substvar that no pkg-js-tools helper defines, so it expands to nothing and the package declares no runtime dependency on node-radix-ui/node-react; and the installed cmdk/package.json points its module and exports.import at dist/index.mjs, which debian/nodejs/build (a CommonJS-only tsc run) never produces.

Issues

blocker licensing 1. Files: * claims the third-party Inter font is Paco Coursey's Expat work; its copyright and licence are missing ◂

Files: website/public/inter-var-latin.woff2, website/styles/globals.scss:1-9, debian/copyright:6-8
Basis: inferred from what was read, not seen directly
Evidence: website/styles/globals.scss:1-9 loads the file as @font-face { font-family: 'Inter'; ... src: url(/inter-var-latin.woff2) format('woff2'); }, while debian/copyright has only Files: * / Copyright: 2022 Paco Coursey / License: Expat plus the debian/* stanza; nothing mentions a font.
Problem: inter-var-latin.woff2 is the Inter font (Debian packages the same font separately as fonts-inter, homepage https://rsms.me/inter/), not something authored by Paco Coursey. It is distributed under the SIL Open Font License 1.1, which requires its copyright notice and licence text to be reproduced; the font is not in /usr/share/common-licenses and no OFL text is in the file. Policy 12.5 requires a verbatim copy of every distribution licence, and the blanket Expat stanza is a false statement about this file.
Fix: Add a stanza for website/public/inter-var-latin.woff2 naming the font's copyright holder (The Inter Project Authors / Rasmus Andersson) with License: OFL-1.1, give the full OFL 1.1 text as a stand-alone License paragraph, and adjust the Files: * stanza so it no longer claims the font; alternatively remove the font (and its @font-face) from the source with Files-Excluded and repack.

important packaging 2. ${nodejs:Depends} is not defined by any pkg-js-tools helper, so node-cmdk ships with no runtime dependencies ◂

Files: debian/control:23
Basis: checked, in the package or with a reference tool
Evidence: Depends: ${nodejs:Depends}, in the binary stanza; dh_nodejs_substvars sets only ${nodejs:Provides} (and exits immediately for a single-binary source), /usr/bin/dh_nodejs_fixperms and the nodejs buildsystem add only ${nodejs:Provides}, ${nodejs:BuiltUsing}, ${nodejs:Version} and misc:Depends; grep for nodejs:Depends over /usr/bin, /usr/share/perl5 and /usr/share finds nothing. deb-substvars(5): "If a variable is referred to but not defined it generates a warning and an empty value is assumed."
Problem: The substvar expands empty, so the binary package ends up with no Depends at all. cmdk's package.json requires @radix-ui/react-dialog, @radix-ui/react-compose-refs, @radix-ui/react-id and @radix-ui/react-primitive (Debian's node-radix-ui) and peer-depends on react/react-dom; installing node-cmdk on its own therefore leaves require('cmdk') failing on missing modules. A dependency that exists nowhere is a real defect, not a substvar-placement nit.
Fix: List the actual runtime dependencies explicitly, e.g. Depends: ${misc:Depends}, node-radix-ui, node-react, node-react-dom (dh_gencontrol adds the relationship substvars at compat 14), or drop ${nodejs:Depends} if no such substvar is intended.

important packaging 3. Installed package.json points module/exports.import at dist/index.mjs, which the CommonJS-only tsc build never creates ◂

Files: debian/nodejs/build, cmdk/package.json:6-19
Basis: inferred from what was read, not seen directly
Evidence: debian/nodejs/build generates a tsconfig with module: "CommonJS" and runs tsc --outDir dist --noCheck --skipLibCheck (only dist/*.js and *.d.ts come out), while cmdk/package.json has "main": "./dist/index.js", "module": "./dist/index.mjs" and "exports": { ".": { "import": "./dist/index.mjs", "require": "./dist/index.js" } }. pkg-js-tools installs that package.json unchanged (install_module copies it; packageMapFiles silently skips the nonexistent .mjs).
Problem: Anything that honours exports or module — import { Command } from 'cmdk' in Node ESM and every bundler used by React consumers (webpack, Vite, Next.js) — resolves to /usr/share/nodejs/cmdk/dist/index.mjs, a file that is not shipped, and fails with ERR_MODULE_NOT_FOUND / "Can't resolve". Only CommonJS require works, and the autopkgtest checks only that path.
Fix: Produce the ESM output the manifest advertises: build with upstream's tsup (format: ['esm','cjs'], adding node-tsup and its build deps), or run a second tsc emitting ESM to dist/index.mjs; or, keeping the CJS-only build, patch package.json so module and exports.import point at ./dist/index.js, which Node can import from ESM.

Verified ◂

All 15 files under debian/ were read; the upstream tree is small (69 files, excluding .pc/ and debian/cargo-checksum.json, absent) and was fully enumerated with glob (hidden and ignored files included).
LICENSE.md is the MIT/Expat text with Copyright (c) 2022 Paco Coursey; Files: * with License: Expat matches it, and a grep for Copyright/(C)/©/SPDX-License-Identifier/Licensed under/GNU/Apache/public domain over the whole tree found no other copyright or licence statement in any text file (cmdk/package.json just says "license": "MIT").
The prescan's author check found every holder it could match already named in debian/copyright; its only holder, Paco Coursey, is present in Files: *.
website/public/favicon.svg, grid.svg, line.svg, vercel.svg and robots.txt contain no copyright/licence metadata and are covered by Files: *; they are upstream website assets, not third-party code.
The other images, website/public/paco.png, rauno.jpeg and og.png, are upstream website assets under the blanket stanza; they were not opened (binary), see unconfirmed.
node-radix-ui is not in the archive yet but is queued in NEW (source node-radix-ui 1.6.7+~3.0.0-1), so the Build-Depends is satisfiable and not reported; node-typescript, node-react, node-react-dom and node-react-remove-scroll exist in unstable.
No debian/patches and 3.0 (quilt) in debian/source/format; debhelper compat 14 with dh-sequence-nodejs and dh-sequence-single-binary (both sequences exist in /usr/share/perl5/Debian/Debhelper/Sequence); Testsuite: autopkgtest-pkg-nodejs with debian/tests/pkg-js/test, which the nodejs buildsystem also runs at build time.
Standards-Version 4.7.4 against Policy 4.7.4.1: current; changelog distribution unstable, version 1.1.1-1, closes #1151619, date valid; Vcs-Git/Vcs-Browser point at the js-team salsa repo; Architecture: all is right for this module.
debian/copyright is DEP-5 with the correct Format URL, Upstream-Name/Source/Upstream-Contact, one Files: * stanza, a debian/* override and the Expat text inline (Expat is not in /usr/share/common-licenses, so inline text is right).
debian/rules' execute_after_dh_auto_install removes debian/node-cmdk/usr/share/nodejs/cmdk-root/, which is where pkg-js-tools puts the whole pnpm workspace root (package name cmdk-root) and the non-root website/test components; after that the binary ships only /usr/share/nodejs/cmdk, so the removal is correct, if inelegant.
The binary is built from cmdk/src with a generated tsconfig and installed by the package.json files field (dist only), with package.json added by pkg-js-tools; no prebuilt or minified code exists in the source tree.
uscan found the packaged version as the newest upstream release (upstream 1.1.1, packaged 1.1.1).

Not confirmed ◂

website/public/paco.png, rauno.jpeg and og.png are binary images that were not opened; a photograph or screenshot of a person is not normally the copyright of the JS author, so if they were not made by Paco Coursey the Files: * attribution is wrong. Their provenance cannot be established from the package.
Whether the generated tsconfig's types: ["node", "react", "react-dom"] makes tsc 6.0 emit TS2688 (cannot find type definition file) despite --noCheck when the @types packages are absent from Build-Depends; I could not check TypeScript's behaviour here, and a build would show it.
debian/watch looks at github.com/dip/cmdk, but the Source field of debian/copyright names github.com/pacocoursey/cmdk. Whether these are the same upstream was not checked.

Proposed changes ◂

None.

Uploader's response to the LLM review

Waiting for the uploader's response until 2026-11-06 19:03 UTC, because the review found serious issues.

Back to Dashboard | View all reviews for this package