DFSG NEW Queue - Review: node-cssfilter 0.0.11-1

Review: node-cssfilter 0.0.11-1

Package Information

Description	CSS declaration sanitizer with configurable allowlist This library parses CSS property declarations, removes comments and filters properties and values against a default or custom allowlist. Rules can allow or reject individual properties, match values with regular expressions or validate them with callback functions. Additional callbacks can replace the output for allowed or rejected declarations and customize value filtering.
Maintainer	Home Assistant Team <team+homeassistant@tracker.debian.org>
Changed By	Edward Betts <edward@4angle.com>
Sponsor	edward@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/homeassistant-team/js/node-cssfilter.git (browse)
Closes	#1149832
Tracker	https://tracker.debian.org/pkg/node-cssfilter
Uploaded	1 month, 5 days ago

New Package Report

.changes◂

Date	Sat, 03 Oct 2026 14:21:33 +0100
Source	node-cssfilter
Version	0.0.11-1
Changed-By	Edward Betts <edward@4angle.com>
Architecture	all source
Distribution	unstable

Changelog◂

node-cssfilter (0.0.11-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1149832)

.dsc◂

Component	main
Package-List	node-cssfilter deb javascript optional arch=all
Section	javascript
Priority	optional

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: cssfilter
Upstream-Contact: Zongmin Lei <leizongmin@gmail.com>
Source: https://github.com/leizongmin/js-css-filter

Files: *
Copyright: 2015-2016 Zongmin Lei(雷宗民) <leizongmin@gmail.com>
License: MIT

Files: debian/*
Copyright: 2026 Edward Betts <edward@4angle.com>
License: MIT


License: MIT
 Permission is hereby granted, free of charge, to any person
 obtaining a copy of this software and associated documentation
 files (the "Software"), to deal in the Software without
 restriction, including without limitation the rights to use,
 copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the
 Software is furnished to do so, subject to the following
 conditions:
 .
 The above copyright notice and this permission notice shall be
 included in all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
 OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
 NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
 HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
 WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
 OTHER DEALINGS IN THE SOFTWARE.

Review Information

accepted — allocated to awm 26 days ago, started 26 days ago, completed 26 days ago.

Final Comment

Hi,

Some pedantic issues found during the review. I'm not sure if the first one is an actual problem, or a misdiagnosis. Similarly with the third, and the second is very minor.

Installed package has no Node.js entry point, so require('cssfilter') fails

Files: debian/node-cssfilter.install, package.json, test/test_css.js, debian/tests/pkg-js/test
Evidence: debian/node-cssfilter.install contains dist usr/share/nodejs/cssfilter; package.json has "main": "lib/index.js"; the upstream tests start with var filterCSS = require('../'); and require('../lib/parser'); debian/tests/pkg-js/test runs mocha -t 5000 -R spec.
Problem: Installing only dist/ puts a browserify UMD bundle (whose top-level IIFE never assigns module.exports) and its minified copy into /usr/share/nodejs/cssfilter/, with no package.json and no lib/. Debian Node.js resolves require('cssfilter') to /usr/share/nodejs/cssfilter/ and needs a package.json "main" (=> lib/index.js) or an index.js there, neither of which is installed, so the module is not loadable by any Node consumer
— the package's only purpose. The pkg-js autopkgtest compounds this: its tests use source-tree-relative requires and mocha/node-should are only listed in Build-Depends-Indep with no debian/tests/control (or debian/tests/pkg-js/control) declaring them as test Depends, so the test cannot run against the installed package.
Fix: Install the loadable module (e.g. lib usr/share/nodejs/cssfilter plus package.json) in debian/node-cssfilter.install, moving the browser bundle (if wanted at all) to /usr/share/javascript or similar, and declare the test dependencies via debian/tests/control (Depends: node-mocha, node-should) so the autopkgtest

Standards-Version 4.7.4 predates the current policy

Files: debian/control
Evidence: Standards-Version: 4.7.4; current Debian Policy is 4.7.4.1 (2026-03-31).
Problem: A brand-new package should declare the current Standards-Version (Policy §4.1).
Fix: Bump to 4.7.4.1 after checking the A10.2 upgrading-checklist entry for anything affecting the package.

uscan finds only upstream versions older than the packaged one

Files: debian/watch
Evidence: upstream 0.0.10, packaged 0.0.11
Problem: The newest version uscan finds with debian/watch is older than the version in debian/changelog, so the watch file does not find the packaged release: it may look in the wrong place, or the versions may need mangling to compare.
Fix: Check where debian/watch looks and how it mangles versions.

Thanks!

Back to Dashboard | View all reviews for this package