node-cssnano 9.9.0+ds1-1

Package Information

Description	modular CSS minifier with configurable optimisation presets Stylesheets are compressed by removing comments and redundant declarations, shortening values and merging rules. Optimisations can be selected and configured through presets, with browser support taken into account.
Maintainer	Home Assistant Team <team+homeassistant@tracker.debian.org>
Changed By	Edward Betts <edward@4angle.com>
Sponsor	edward@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/homeassistant-team/js/node-cssnano.git (browse)
Closes	#998021
Tracker	https://tracker.debian.org/pkg/node-cssnano
Uploaded	2 hours ago

New Package Report

.changes◂

Changed-By	Edward Betts <edward@4angle.com>
Architecture	all source
Distribution	unstable
Date	Wed, 04 Nov 2026 16:56:20 +0000
Source	node-cssnano
Version	9.9.0+ds1-1

Changelog◂

node-cssnano (9.9.0+ds1-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #998021)

.dsc◂

Section	javascript
Priority	optional
Component	main
Package-List	node-cssnano deb javascript optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: cssnano
Upstream-Contact: Ben Briggs <beneb.info@gmail.com>
Source: https://github.com/cssnano/cssnano
Files-Excluded: site/src/assets/undraw_config.svg
 site/src/assets/undraw_settings.svg
 frameworks/*
 packages/cssnano/test/presets/*/integrations/*

Files: *
Copyright: Ben Briggs <beneb.info@gmail.com> (https://beneb.info)
License: Expat

Files: packages/cssnano/src/plugins/postcss-discard-overridden/*
 packages/cssnano/types/plugins/postcss-discard-overridden/*
Copyright: 2016 Justineo <justice360@gmail.com>
 Ben Briggs <beneb.info@gmail.com> (https://beneb.info)
License: Expat

Files: packages/cssnano/src/plugins/postcss-minify-font-values/*
 packages/cssnano/types/plugins/postcss-minify-font-values/*
 packages/cssnano/docs/postcss-minify-font-values/README.md
Copyright: Bogdan Chadkin <trysound@yandex.ru>
 Ben Briggs <beneb.info@gmail.com> (https://beneb.info)
License: Expat

Files: packages/cssnano/src/plugins/postcss-minify-params/*
 packages/cssnano/types/plugins/postcss-minify-params/*
 packages/cssnano/docs/postcss-minify-params/README.md
Copyright: 2015 Bogdan Chadkin <trysound@yandex.ru>
 Ben Briggs <beneb.info@gmail.com> (https://beneb.info)
License: Expat

Files: packages/cssnano/src/plugins/postcss-normalize-charset/*
 packages/cssnano/types/plugins/postcss-normalize-charset/*
 packages/cssnano/docs/postcss-normalize-charset/README.md
Copyright: 2015 Bogdan Chadkin <trysound@yandex.ru>
 Ben Briggs <beneb.info@gmail.com> (https://beneb.info)
License: Expat

Files: packages/cssnano/src/plugins/postcss-colormin/data/colorProperties.json
 packages/cssnano/src/plugins/postcss-merge-idents/data/mergeIdents.json
 packages/cssnano/src/plugins/postcss-merge-longhand/data/knownProperties.json
 packages/cssnano/src/plugins/postcss-merge-longhand/data/longhands.json
 packages/cssnano/src/plugins/postcss-merge-longhand/data/numericRanges.json
 packages/cssnano/src/plugins/postcss-merge-longhand/data/shorthandIdentities.json
 packages/cssnano/src/plugins/postcss-merge-rules/data/propertyGroups.json
 packages/cssnano/src/plugins/postcss-minify-font-values/data/cssWideKeywords.json
 packages/cssnano/src/plugins/postcss-ordered-values/rules/*.json
 packages/cssnano/src/plugins/postcss-reduce-idents/data/identSlots.json
Copyright: 2020 World Wide Web Consortium
 Ben Briggs <beneb.info@gmail.com> (https://beneb.info)
License: Expat
Comment: Generated from @webref/css (MIT). The corresponding acquire.js scripts
 record the provenance. See https://github.com/w3c/webref/blob/main/LICENSE.

Files: packages/cssnano/src/plugins/postcss-reduce-initial/data/*.json
 packages/cssnano/src/plugins/postcss-merge-longhand/data/boxPropertySupport.json
 packages/cssnano/src/plugins/postcss-merge-longhand/data/pairSupport.json
 packages/cssnano/src/plugins/postcss-merge-longhand/data/placeSupport.json
Copyright: MDN Web Docs
 Ben Briggs <beneb.info@gmail.com> (https://beneb.info)
License: CC0-1.0 and Expat
Comment: Generated from mdn-data and @mdn/browser-compat-data (CC0-1.0), with
 cssnano-specific corrections and processing (MIT).

Files: packages/cssnano/src/plugins/postcss-merge-longhand/data/featureSupport.json
Copyright: MDN Web Docs
 caniuse.com contributors
 Ben Briggs <beneb.info@gmail.com> (https://beneb.info)
License: CC0-1.0 and CC-BY-4.0 and Expat
Comment: Generated from @mdn/browser-compat-data and tightened using caniuse-lite
 compatibility data. Sources: https://github.com/mdn/browser-compat-data
 and https://caniuse.com/. The generator changes the representation and
 combines both data sources; see script/postcss-merge-longhand/acquire.js.

Files: debian/*
Copyright: 2026 Edward Betts <edward@4angle.com>
License: Expat

License: Expat
 Permission is hereby granted, free of charge, to any person
 obtaining a copy of this software and associated documentation
 files (the "Software"), to deal in the Software without
 restriction, including without limitation the rights to use,
 copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the
 Software is furnished to do so, subject to the following
 conditions:
 .
 The above copyright notice and this permission notice shall be
 included in all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
 OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
 NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
 HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
 WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
 OTHER DEALINGS IN THE SOFTWARE.

License: CC0-1.0
 The data is made available under the CC0 1.0 Universal Public Domain
 Dedication. On Debian systems, the full text is in
 /usr/share/common-licenses/CC0-1.0.

License: CC-BY-4.0
 The data is licensed under the Creative Commons Attribution 4.0
 International Public License. On Debian systems, the full text is in
 /usr/share/common-licenses/CC-BY-4.0.

DFSG Assistant LLM REVIEW 0 blocker, 1 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 hour ago.

Report◂

DFSG NEW review for node-cssnano version 9.9.0+ds1-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: No
Issues: 0 blocker, 1 important, 1 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The tree is offered under the Expat (MIT) licence, with the four plugins absorbed from external projects (postcss-discard-overridden, postcss-minify-font-values, postcss-minify-params, postcss-normalize-charset) attributed to Justineo and Bogdan Chadkin in both LICENSE-MIT and debian/copyright. The generated data under packages/cssnano/src/plugins/*/data/ and postcss-ordered-values/rules/ is matched by Files stanzas for W3C/webref data (Expat), MDN/browser-compat-data (CC0-1.0) and the caniuse-derived featureSupport.json (CC0-1.0, CC-BY-4.0 and Expat); all three licences are DFSG-free and compatible, and the full Expat text plus pointers to /usr/share/common-licenses/CC0-1.0 and CC-BY-4.0 are present. No non-free terms, no unlicensed file, and no built or minified artefact lacking its source was found; the prescan found every copyright holder already named. The remaining doubt is only the provenance of one site logo, listed under unconfirmed.

Packaging

The packaging is close to the modern dh-nodejs shape (compat 14, single binary, nodejs add-ons, autopkgtest files, clean debian/copyright), but the dependency list is wrong: both Build-Depends and Depends name node-postcss-calc, a binary package that exists neither in the archive nor in NEW, although presets/default.js imports postcss-calc unconditionally, so the package can be neither built nor installed. Depends also omits the package that provides @csstools/css-tokenizer, which the source imports directly and which debian/nodejs/links symlinks into the installed module.

Issues

important packaging 1. Build-Depends and Depends name node-postcss-calc, which exists in neither the archive nor NEW, and the default preset imports postcss-calc unconditionally ◂

Files: debian/control:14 (Build-Depends: node-postcss-calc), debian/control (Package: node-cssnano, Depends: node-postcss-calc), packages/cssnano/src/presets/default.js:6, debian/nodejs/links:7, debian/nodejs/extlinks:6
Basis: checked, in the package or with a reference tool
Evidence: packages/cssnano/src/presets/default.js:6: import postcssCalc from 'postcss-calc'; and package.json "postcss-calc": "^11.2.2". apt-cache for node-postcss-calc: "There is no binary package named node-postcss-calc in these lists, and nothing provides it. Nor is it a binary of this package or of any upload waiting in the NEW queues". postcss-calc is also a peer of nothing else in the Build-Depends: node-postcss, node-browserslist, node-caniuse-api and node-colordx-core do not provide it.
Problem: The declared build dependency cannot be satisfied in a clean unstable chroot, and even if the build were forced the resulting binary would be uninstallable because its Depends names a package that does not exist. The default preset loads postcss-calc at import time, so cssnano cannot work without it.
Fix: Get postcss-calc (node-postcss-calc) into the archive first, or add it to the Depends of the ITP blocking this one; if it is already pending acceptance, keep the version in debian/control consistent with the packaged version and note it in the changelog.

minor packaging 2. Depends does not list node-csstools-postcss-plugins, which provides the directly imported @csstools/css-tokenizer ◂

Files: debian/control (Depends), debian/nodejs/links:2, packages/cssnano/src/plugins/postcss-discard-comments/lib/tokenUtils.js:1
Basis: checked, in the package or with a reference tool
Evidence: import { tokenize, TokenType } from '@csstools/css-tokenizer'; appears in postcss-discard-comments, postcss-discard-unused, postcss-merge-idents, postcss-merge-longhand and postcss-reduce-idents; debian/nodejs/links maps @csstools/css-tokenizer cssnano/node_modules/@csstools/css-tokenizer; apt-cache shows node-csstools-css-tokenizer is a virtual package provided by node-csstools-postcss-plugins (= 4.0.2), and no other Build-Depends/Depends in debian/control provides it.
Problem: A module imported directly at runtime should be a direct dependency. As written the symlink created by debian/nodejs/links resolves only if some other package happens to pull node-csstools-postcss-plugins in transitively; the same module is also needed by the build-time nodepath lookup driven by debian/nodejs/extlinks.
Fix: Add node-csstools-postcss-plugins to both Build-Depends and the binary Depends.

Verified ◂

Prescan: it reported no file list and no missing holder ("every holder found is named in debian/copyright"); I re-checked the tree-wide greps for Copyright/(C)/©/SPDX and found only the known holders (Ben Briggs, Justineo, Bogdan Chadkin) plus the README licence footers, and the 7 holders in debian/copyright match.
Read in full: debian/control, rules, changelog, source/format, source/options, copyright, nodejs/{main,build,links,extlinks,additional_components}, node-cssnano.docs, tests/pkg-js/{test,files,require-name,core.cjs}, upstream/metadata. No patches, no maintainer scripts, no gbp.conf.
Licence files read: LICENSE-MIT (root, example-cli-usage, packages/cssnano, packages/postcss-svgo). packages/cssnano/LICENSE-MIT carries the three extra derivative notices for postcss-discard-overridden, postcss-minify-font-values, postcss-minify-params and postcss-normalize-charset, exactly as the four Files stanzas in debian/copyright state.
Data files: all 14 JSON files under packages/cssnano/src/plugins/*/data/ plus postcss-ordered-values/rules/{cssWideKeywords,easingFunctions}.json are covered by the W3C or MDN stanzas; they carry no embedded notice. flowRelativeSides.json (not in a data stanza) is hand-derived table data from script/postcss-merge-longhand/lib/writingModes.js, so Files: * is correct for it.
Files-Excluded in debian/copyright: the named paths (site/src/assets/undraw_config.svg, site/src/assets/undraw_settings.svg, frameworks/, packages/cssnano/test/presets//integrations/*) are all absent from the unpacked tree, so copyright does not claim to have removed files that are still shipped.
No minified JS, PDF, font or other binary artefact was found; packages/cssnano/types/**.d.ts and .d.ts.map are TypeScript declarations generated from the JSDoc in src, whose sources and tsconfig.json are both present. The only raster/vector assets are logos and site artwork (media/.svg, site/public/img/, site/src/assets/), listed as verified below/unconfirmed.
CC0-1.0 and CC-BY-4.0 both exist in /usr/share/common-licenses, so the two pointers in debian/copyright resolve. Expat + CC0-1.0 + CC-BY-4.0 are compatible and DFSG-free.
Policy 4.7.4.1 on the reviewing system; Standards-Version 4.7.4 is current under the first-two-components rule. Source format 3.0 (quilt), distribution unstable, version 9.9.0+ds1-1 consistent with Upstream-Name/Homepage and the maintainer's repack suffix.
debhelper compat 14 with dh-sequence-nodejs-no-lerna and dh-sequence-single-binary; both add-ons exist in /usr/share/perl5/Debian/Debhelper/Sequence (nodejs_no_lerna.pm, single_binary.pm), and single_binary.pm applies to a one-stanza control file. debian/nodejs/build is empty but is not reached for the packages/cssnano component (the build system looks under debian/nodejs/packages/cssnano/), so it is harmless and no upstream build script is run.
debian/nodejs/links and extlinks list the same six modules (the five package.json dependencies plus the postcss peer); packages/postcss-svgo is correctly not installed (only debian/nodejs/main = packages/cssnano is the component) and its svgo dependency therefore never matters.
Breaks/Replaces: node-cssnano-core on a package that never existed is a no-op; noted, not counted as a fault.
Node.js in the archive is 24.22.2, satisfying cssnano's engines (^24.15.0), and node-postcss 8.5.31 satisfies the ^8.5.29 peer; the other declared dependency versions (@colordx/core 7.3.0, @csstools/css-tokenizer 4.0.2, browserslist 4.28.7) are present at satisfying or semver-compatible versions.
uscan found the packaged version as the newest upstream release (upstream 9.9.0, packaged 9.9.0+ds1).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (CC-BY-4.0, CC0-1.0).

Not confirmed ◂

site/src/assets/postcss.svg has the SVG title "postcss-logo-symbol" and looks like the PostCSS project's logo copied in for the website; no copyright or licence notice is inside the file, so its holder cannot be established from the package. Files: * attributes the whole tree to Ben Briggs alone; if the file is the PostCSS logo this is a (small) missing attribution. Similar doubt, smaller, for site/public/img/opencollective-button@2x.png.
node-postcss-calc is reported missing from the local package lists and the NEW queue as of 2026-11-09; if it was accepted in the days since, the first issue reduces to keeping the dependency list in step with the accepted version.
Why the model asked for what a review has no use for. During this review it asked once for something outside the package and the reviewing system (another file of the sandbox, or a URL), or was given part of the review tooling's own configuration, and that was refused or withheld. A model does this when something it has read tells it to, so look in the package for text addressed to a reviewing program, and treat this report with suspicion. Refused: glob: "/**/pkg-js*" is not a file of the package or of the reviewing system.

Proposed changes ◂

None.

Uploader's response to the LLM review

The node-postcss-calc package is NEW, it has been accepted.

I'll add node-csstools-postcss-plugins to Depends on my next upload.

— Edward Betts (edward), 0 hours ago

Back to Dashboard | View all reviews for this package