Review: node-cmdk 1.1.1+ds-1

Package Information

Description	fast, composable, unstyled command menu React component cmdk is a high-performance, accessible, and fully customizable command menu component for React applications. It provides quick keyboard navigation, fuzzy searching, and flexible item composition without imposing any default styles. This package provides the cmdk command menu library for Node.js environments.
Maintainer	Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed By	Andrew Lee (李健秋) <ajqlee@debian.org>
Sponsor	ajqlee@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/js-team/node-cmdk.git (browse)
Closes	#1151619
Tracker	https://tracker.debian.org/pkg/node-cmdk
Uploaded	1 day ago
Supersedes	1.1.1-1

New Package Report

.changes◂

Date	Fri, 06 Nov 2026 10:16:42 +0100
Source	node-cmdk
Version	1.1.1+ds-1
Changed-By	Andrew Lee (李健秋) <ajqlee@debian.org>
Architecture	source all
Distribution	unstable

Changelog◂

node-cmdk (1.1.1+ds-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1151619)

.dsc◂

Package-List	node-cmdk deb javascript optional arch=all
Section	javascript
Priority	optional
Component	main

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: cmdk
Upstream-Contact: https://github.com/dip/cmdk/issues
Source: https://github.com/pacocoursey/cmdk
Files-Excluded:
 website

Files: *
Copyright: 2022 Paco Coursey
License: Expat

Files: debian/*
Copyright: Andrew Lee (李健秋) <ajqlee@debian.org>
License: Expat

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 1 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 day ago.

Report◂

DFSG NEW review for node-cmdk version 1.1.1+ds-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: No
Issues: 0 blocker, 1 important, 2 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The whole upstream tree is MIT (DEP-5 short name Expat) held by Paco Coursey, as LICENSE.md states, and debian/copyright is a correct and complete DEP-5 file: Files: * for the upstream files, a separate debian/* stanza for Andrew Lee, and the full Expat text. No other copyright notice, licence file or non-free term exists anywhere in the ~30 upstream files, the licence text is included in full, and the +ds repack matches Files-Excluded: website, which is absent from the tree. No built, minified or otherwise undistributable files are shipped.

Packaging

The packaging is conventional and mostly well done (compat 14 with the right dh sequences, 3.0 (quilt), DEP-5 copyright, a correct +ds repack, autopkgtest-pkg-nodejs), but the binary declares no runtime dependencies at all: ${nodejs:Depends} is not a substvar that dh-sequence-nodejs produces any more, and the four @radix-ui modules the module loads are not packaged in Debian. The Build-Depends entry node-radix-ui does not exist in the archive or in NEW, so the package cannot be built in a clean chroot, and package.json advertises an ESM entry (dist/index.mjs) that the tsc build never creates.

Issues

important packaging 1. Depends: ${nodejs:Depends} is not produced by dh-sequence-nodejs, so node-cmdk gets no runtime dependencies ◂

Files: debian/control:23, cmdk/src/index.tsx:3-8
Basis: checked, in the package or with a reference tool
Evidence: debian/control has Depends: ${nodejs:Depends}, as the package's only dependency field. dh-nodejs 0.17.14 emits only ${nodejs:Provides}, ${nodejs:BuiltUsing}, ${nodejs:Version} and misc:Depends (nodejs:any when a /usr/bin link is installed) - /usr/share/perl5/Debian/Debhelper/Buildsystem/nodejs.pm, /usr/share/perl5/Debian/Debhelper/Sequence/nodejs.pm, /usr/bin/dh_nodejs_*, /usr/share/perl5/Debian/PkgJs/*.pm and /usr/bin/dh_computeautosubstvars contain no nodejs:Depends. deb-substvars(5): If a variable is referred to but not defined it generates a warning and an empty value is assumed. The installed module needs them: import * as RadixDialog from '@radix-ui/react-dialog', import * as React from 'react' and the related @radix-ui imports are compiled by the tsc build into top-level requires in dist/index.js.
Problem: The binary ends up with an empty Depends, so nothing pulls in node-react, node-react-dom or the @radix-ui modules. require('cmdk') then fails with "Cannot find module" on any system that does not already happen to have them, which violates Policy 3.5 (every package must declare the dependencies required for it to work).
Fix: Drop ${nodejs:Depends} and name the real binary packages explicitly in Depends, e.g. node-react, node-react-dom and the packages that provide @radix-ui/react-dialog, -compose-refs, -id and -primitive (see the next issue), so that the required modules are guaranteed to be present.

minor packaging 2. Build-Depends node-radix-ui exists in neither the archive nor NEW, and the @radix-ui modules it is meant to supply are unpackaged ◂

Files: debian/control:10
Basis: checked, in the package or with a reference tool
Evidence: node-radix-ui, in Build-Depends. apt-cache show node-radix-ui: There is no binary package named node-radix-ui in these lists, and nothing provides it. Nor is it a binary of this package or of any upload waiting in the NEW queues; the same answer came for node-radix-ui-react-dialog, node-radix-ui-react-primitive, node-radix-ui-react-slot, node-radix-ui-react and node-radix-ui-primitives.
Problem: An unsatisfiable Build-Depends makes the package fail dependency resolution in a clean sbuild/pbuilder chroot. The package also loads @radix-ui/react-dialog, @radix-ui/react-compose-refs, @radix-ui/react-id and @radix-ui/react-primitive at runtime, and none of these modules is shipped by any Debian package, so even a successful build would produce a module that cannot be loaded.
Fix: Package the Radix UI modules (or have them uploaded and accepted, naming the actual binary packages in the dependencies), then depend on the real binary names in Build-Depends and Depends instead of the non-existent node-radix-ui.

minor packaging 3. package.json points module and the exports import condition at dist/index.mjs, which the tsc build never creates ◂

Files: cmdk/package.json:6, cmdk/package.json:14, debian/nodejs/build:28
Basis: inferred from what was read, not seen directly
Evidence: "module": "./dist/index.mjs" and "import": "./dist/index.mjs"; the Debian build runs tsc --outDir dist --noCheck --skipLibCheck with "module": "CommonJS" in the tsconfig it writes, so dist contains index.js and index.d.ts only. Upstream produces dist/index.mjs with tsup, which the packaging replaces with tsc.
Problem: Node resolves the import condition of the exports map for import { Command } from 'cmdk', finds no dist/index.mjs and fails with ERR_MODULE_NOT_FOUND; the module field is a dangling reference for bundlers as well. The installed package claims an ESM entry point it does not contain.
Fix: Either generate an ESM entry as part of debian/nodejs/build (upstream uses tsup; mjs2cjs is the wrong direction) or strip module and the import and types-adjacent exports conditions that refer to the missing file from the installed package.json, so that every advertised entry point exists.

Verified ◂

Read all of debian/ except debian/watch (out of scope): control, rules, changelog, copyright, gbp.conf, salsa-ci.yml, source/format, nodejs/{build,additional_components,root_modules,extlinks}, tests/pkg-js/test and upstream/metadata. There are no patches and no maintainer scripts.
The whole upstream tree is 30 files: top-level config and docs, .github/, .husky/, cmdk/ (package.json, tsup.config.ts, src/index.tsx, src/command-score.ts) and test/ (Playwright tests plus a Next.js test app). No dist/, minified code, PDF, image, font or other binary file is present.
LICENSE.md is the MIT/Expat text with Copyright (c) 2022 Paco Coursey; cmdk/package.json declares "license": "MIT". A grep of the whole tree for Copyright, (C), (c), SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU General Public/Lesser, Apache License, Mozilla Public, public domain and All rights reserved matched only LICENSE.md; no LICENSE, COPYING or NOTICE exists in any subdirectory.
debian/copyright is DEP-5 with the canonical Format URL: Files: * (2022 Paco Coursey, Expat), a later Files: debian/* stanza (Andrew Lee, Expat) that correctly overrides it, and the full Expat licence text, so no /usr/share/common-licenses pointer is needed. The pre-scan's author check reported that every holder found is named.
Files-Excluded: website is consistent with the tree: no website/ directory is present, which is why the version is 1.1.1+ds.
cmdk/dist is absent from the source, so no built file is shipped without its source; it is produced by debian/nodejs/build from cmdk/src.
test/ is upstream's own Playwright end-to-end suite and Next.js demo pages, under the same Expat licence; it is test data, not installed.
Packaging mechanics check out: debhelper compat 14 with dh-sequence-single-binary and dh-sequence-nodejs, 3.0 (quilt), Standards-Version 4.7.4 (current Policy 4.7.4.1), Section javascript, Architecture all, Vcs-* and Homepage present, an ITP closure in the changelog, and dh_auto_test runs debian/tests/pkg-js/test (dependencies are linked into node_modules from debian/nodejs/extlinks).
The extra 'dh-sequence-single-binary' is correct for compat 14 and matches the rm -rf debian/node-cmdk/usr/share/nodejs/cmdk-root/ in rules, which drops the private pnpm workspace root (package.json name cmdk-root) so that only the cmdk module is installed under /usr/share/nodejs/cmdk.
uscan found the packaged version as the newest upstream release (upstream 1.1.1, packaged 1.1.1+ds).

Not confirmed ◂

The autodep8/pkg-js autopkgtest harness is not installed on the reviewing system, so I could not check how debian/tests/pkg-js/test is invoked under Testsuite: autopkgtest-pkg-nodejs; it needs cmdk/dist, which only exists in a built source tree.
I did not verify that node-typescript 6.0.3 still accepts every option that debian/nodejs/build writes into cmdk/tsconfig.json (in particular moduleResolution: "node" with ignoreDeprecations: "6.0"); a build would show it.
The .dsc and the tarballs beside the tree were only used to confirm the version and the +ds repack; I did not compare their full file lists with the unpacked tree.
debian/watch looks at github.com/dip/cmdk, but the Source field of debian/copyright names github.com/pacocoursey/cmdk. Whether these are the same upstream was not checked.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader rejected this upload in response to the review.

Review Information

rejected — allocated to dfsg-uploader 1 day ago, started 1 day ago, completed 1 day ago.

Final Comment

The uploader rejected this upload in response to the automated (LLM) review of it, so that they can fix the problems it found and upload again.

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
1.1.1-1	705f6964…	2026-11-06 10:35	2026-11-06 10:35	dfsg-uploader	rejected	VIEW

Back to Dashboard | View all reviews for this package