Review: node-codemirror-lang-yaml 6.1.3-1

Package Information

Description	YAML language support for the CodeMirror code editor CodeMirror is a code editor component for the web. It can be used in websites to implement a text input field with support for many editing features, and has a rich programming interface to allow further extension. This package provides the YAML language support.
Maintainer	Home Assistant Team <team+homeassistant@tracker.debian.org>
Changed By	Edward Betts <edward@4angle.com>
Sponsor	edward@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/homeassistant-team/js/node-codemirror-lang-yaml.git (browse)
Closes	#1152200
Tracker	https://tracker.debian.org/pkg/node-codemirror-lang-yaml
Uploaded	12 days ago

New Package Report

.changes◂

Source	node-codemirror-lang-yaml
Version	6.1.3-1
Changed-By	Edward Betts <edward@4angle.com>
Architecture	all source
Distribution	unstable
Date	Mon, 26 Oct 2026 15:59:16 +0000

Changelog◂

node-codemirror-lang-yaml (6.1.3-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1152200)

.dsc◂

Section	javascript
Priority	optional
Component	main
Package-List	node-codemirror-lang-yaml deb javascript optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: @codemirror/lang-yaml
Upstream-Contact: Marijn Haverbeke <marijn@haverbeke.berlin>
Source: https://github.com/codemirror/lang-yaml

Files: *
Copyright: 2024 Marijn Haverbeke <marijn@haverbeke.berlin> and others
License: MIT

Files: debian/*
Copyright: 2026 Edward Betts <edward@4angle.com>
License: MIT

License: MIT
 Permission is hereby granted, free of charge, to any person obtaining a
 copy of this software and associated documentation files (the "Software"),
 to deal in the Software without restriction, including without limitation
 the rights to use, copy, modify, merge, publish, distribute, sublicense,
 and/or sell copies of the Software, and to permit persons to whom the
 Software is furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 DEALINGS IN THE SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 11 days ago.

Report◂

DFSG NEW review for node-codemirror-lang-yaml version 6.1.3-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 with the canonical Format: URL. The tree is eleven upstream files, all under the top-level MIT LICENSE, whose only copyright notice is Copyright (C) 2024 by Marijn Haverbeke <marijn@haverbeke.berlin> and others; the Files: * stanza names that holder and licence, the debian/* stanza names the packager, and the full MIT text is included (MIT is not in /usr/share/common-licenses). There is no vendored third-party code, no prebuilt or minified file, and each generated file (README.md, the build output) has its source and generator in the tree. DFSG-compliant and accurately described.

Packaging

A plain debhelper compat 14 package using the pkg-js-tools/dh-nodejs sequences: debian/rules is dh $@, the build is driven by debian/nodejs/build calling debian/build.cjs (lezer-generator, esbuild, rollup, tsc), and debian/nodejs/files installs dist plus the generated package.json. The generated artefacts are removed by debian/clean, Build-Depends cover every tool and module the build needs, Depends mirrors upstream's package.json dependencies, the patch is a documented dgit combined diff and is applied, and there is a pkg-js autopkgtest. Version, distribution, Vcs-* and Standards-Version are in order.

Issues

None.

Verified ◂

Read every upstream file in full: LICENSE, README.md, CHANGELOG.md, package.json, .gitignore, .npmignore, src/yaml.ts, src/README.md, src/frontmatter.grammar, src/frontmatter.grammar.d.ts, .github/workflows/dispatch.yml, and every file under debian/ except debian/watch (not in scope) and debian/changelog read in full.
Prescan author check ("every holder found is named in debian/copyright") matches what I found: the only upstream copyright notice is LICENSE:3, Copyright (C) 2024 by Marijn Haverbeke <marijn@haverbeke.berlin> and others, named by the Files: * stanza; the packaging holder (Edward Betts) is named by Files: debian/*.
No other licence or copyright wording anywhere in the tree: a grep for Copyright, (C), SPDX-License-Identifier, GNU General/Lesser, Apache License, Mozilla Public, public domain, all rights reserved and Permission is hereby granted over src/, README.md, CHANGELOG.md, package.json, LICENSE and .github/ returns only LICENSE.
No prebuilt code: the orig tarball has no dist/, .gitignore and .npmignore both exclude it, and dist/ is produced by debian/build.cjs from src/yaml.ts and src/frontmatter.grammar; debian/clean removes dist/, debian/types/, src/frontmatter.grammar.js and .terms.js. README.md is generated from src/README.md, which is present.
No binaries, images, fonts or archives in the tree; all eleven upstream files are text.
debian/patches/series has the one dgit-changes patch, the dgit-maint-merge combined diff; its single hunk (import of ./frontmatter.grammar.js instead of ./frontmatter.grammar) is present in src/yaml.ts:6.
The debian/nodejs/files line dist plus the package.json that dh-nodejs adds automatically give the complete module; the package.json files/main/exports fields match what is installed.
debian/control Depends mirrors upstream package.json dependencies (@codemirror/autocomplete, @codemirror/language, @codemirror/state, @lezer/common, @lezer/highlight, @lezer/lr, @lezer/yaml), with node-lezer-common providing node-lezer-highlight (1.2.3) and node-lezer-lr (1.4.8) per apt-cache, plus node-codemirror-view and node-crelt.
Standards-Version 4.7.4 against Policy 4.7.4.1: the first two components match, so it is current.
The dh addons resolve on this system: debhelper 14.5 provides dh-sequence-single-binary, dh-nodejs 0.17.14 provides dh-sequence-nodejs-no-lerna and carries the buildsystem that dh $@ reaches (read /usr/share/perl5/Debian/Debhelper/Sequence/nodejs*.pm and Buildsystem/nodejs*.pm).
Build-Depends resolve in the archive: esbuild 0.28.2 (Provides node-esbuild), rollup 3.30.0, node-typescript 6.0.3 (>= 5.6, the version that introduced noCheck), node-lezer-generator, node-rollup-plugin-dts, node-rollup-plugin-json, node-rollup-plugin-node-resolve, and the node-codemirror/node-lezer packages. node-lezer-yaml is absent from the archive but apt-cache reports it built by node-lezer-yaml 1.0.4-1 waiting in NEW, so it is not a fault.
debian/tests/pkg-js/test and test.cjs are the pkg-js pattern that Testsuite: autopkgtest-pkg-nodejs expects, and the same test is what the nodejs buildsystem runs at build time (sub test in Buildsystem/nodejs.pm).
changelog: 6.1.3-1, unstable, initial release closing #1152200, dated Mon, 26 Oct 2026; Vcs-Git/Vcs-Browser match the .dsc, and the .dsc lists only the two tarballs (debian tarball holds only debian/).
uscan found the packaged version as the newest upstream release (upstream 6.1.3, packaged 6.1.3).

Not confirmed ◂

No build was attempted: lezer-generator, tsc, rollup, esbuild and the node module packages are not installed on the reviewing system, so the calls in debian/build.cjs and the build-time run of debian/tests/pkg-js/test were not observed.
Whether the omission of @lezer/yaml from debian/nodejs/extlinks matters: src/yaml.ts:1 imports it, but debian/tsconfig.json sets noCheck, so tsc's declaration emit should not need to resolve it, and it is a runtime Depends; a build would show whether anything else needs the node_modules link.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 11 days ago.

Review Information

accepted — allocated to babelouest 11 days ago, started 11 days ago, completed 11 days ago.

Final Comment

Back to Dashboard | View all reviews for this package