Review: node-esmoduleserve 0.3.3-1

Package Information

Description	ES module server for Node.js Serves ES modules from node_modules to the browser, rewriting their CommonJS dependencies on the fly, so that a test page can load them with a plain import. Node.js is an event-based server-side JavaScript engine.
Maintainer	Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed By	Emfox Zhou <emfox@debian.org>
Sponsor	emfox@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/js-team/node-esmoduleserve.git (browse)
Closes	#1150578
Tracker	https://tracker.debian.org/pkg/node-esmoduleserve
Uploaded	27 days ago

New Package Report

.changes◂

Architecture	source all
Distribution	unstable
Date	Sun, 11 Oct 2026 10:30:00 +0800
Source	node-esmoduleserve
Version	0.3.3-1
Changed-By	Emfox Zhou <emfox@debian.org>

Changelog◂

node-esmoduleserve (0.3.3-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1150578)

.dsc◂

Component	main
Package-List	node-esmoduleserve deb javascript optional arch=all
Section	javascript
Priority	optional

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: esmoduleserve
Source: https://code.haverbeke.berlin/marijn/esmoduleserve

Files: *
Copyright: 2020 Marijn Haverbeke <marijn@haverbeke.berlin>
License: Expat

Files: debian/*
Copyright: 2026 Emfox Zhou <emfox@debian.org>
License: Expat

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a
 copy of this software and associated documentation files (the "Software"),
 to deal in the Software without restriction, including without limitation
 the rights to use, copy, modify, merge, publish, distribute, sublicense,
 and/or sell copies of the Software, and to permit persons to whom the
 Software is furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 DEALINGS IN THE SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 24 days ago.

Report◂

DFSG NEW review for node-esmoduleserve version 0.3.3-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable

Licensing

Every file in the source tree is MIT/Expat. The upstream LICENSE file grants the standard MIT/Expat terms to Marijn Haverbeke 2020, package.json declares "MIT", and README.md confirms "open-source under an MIT license". debian/copyright is in DEP-5 format with the canonical 1.0 Format URL. Files: * correctly covers all upstream files (the * wildcard in copyright-format matches slashes, so nothing escapes) with the correct holder and Expat license, and the full Expat text is reproduced in the stand-alone License stanza; Files: debian/* covers the packaging for the maintainer with Expat. No binary blobs, no minified/generated code, no vendored third-party code, no non-free terms, and no files lacking a license. Nothing is missing from the archive mapping.

Packaging

Packaging follows current pkg-js-team practice and passes sponsor review. debhelper-compat 14 with dh, dh-sequence-single-binary and dh-sequence-nodejs; Architecture: all single binary; hardening is on by default via dh. Build-Depends and Depends packages all exist in the archive with versions satisfying upstream ranges (node-acorn 8.17.0, node-acorn-walk via node-acorn, node-import-meta-resolve 4.2.0). The single patch relaxes serve-static to accept 2.x (Debian ships 2.2.1; upstream demands ^1.14.1), with a clear DEP-3 header; call sites use the middleware signature unchanged in 2.x. Autopkgtest present via Testsuite: autopkgtest-pkg-nodejs + debian/tests/pkg-js with a minimal file-existence check, reasonable since upstream ships no tests and require() would start an HTTP server. Changelog, Vcs-*, upstream/metadata, gbp.conf all sane; Standards-Version 4.7.4 is current.

Issues

None.

Verified ◂

Read debian/copyright, control, rules, changelog, source/format, gbp.conf, upstream/metadata, patches/series + the single patch, and debian/tests/pkg-js/{test,require-SKIP} in full.
Enumerated every non-.pc, non-debian file via glob with gitignore:false: .gitignore, index.js, LICENSE, moduleserver.js, package.json, README.md; confirmed the orig tarball contains exactly this set (top dir esmoduleserve/).
Grep of the whole tree (gitignore:false) found no other copyright/license markers, no additional copyright lines, no licenses beyond Expat; LICENSE text matches the Expat stanza in debian/copyright verbatim.
Confirmed via apt-cache that node-acorn (8.17.0), node-acorn-walk (provided =8.3.5 by node-acorn), node-import-meta-resolve (4.2.0), and node-serve-static (2.2.1) exist and satisfy all upstream semver ranges; node-serve-static 2.x satisfies the patched ^1.14.1 || ^2.0.0.
Verified no binary files (images, fonts, archives) exist in the source tree.
Index.js call to serve-static is (req, resp, next) middleware form, unchanged between 1.x and 2.x.
uscan found the packaged version as the newest upstream release (upstream 0.3.3, packaged 0.3.3).

Not confirmed ◂

Could not build the package or run the autopkgtest on this system; autopkgtest coverage rests on the standard pkg-js-tools mechanism (Testsuite field + dh-sequence-nodejs).
Did not verify runtime API compatibility of serve-static 2.x beyond the documented middleware signature; no upstream test suite exists to exercise it.
Did not confirm ITP bug #1150578 exists in the archive (no network tool for the BTS).

Proposed changes ◂

None.

Review Information

accepted — allocated to awm 24 days ago, started 24 days ago, completed 24 days ago.

Final Comment

Back to Dashboard | View all reviews for this package