Review: node-idb-keyval 6.3.0-2
Package Information
| Description | promise-based key-value store using IndexedDB This library stores values using the browser's IndexedDB API. It supports retrieving, updating and deleting individual entries, batch operations, and listing keys, values or key-value pairs. Custom databases and object stores can be selected, and updates can be performed atomically. |
|---|---|
| Maintainer | Home Assistant Team <team+homeassistant@tracker.debian.org> |
| Changed By | Edward Betts <edward@4angle.com> |
| Sponsor | edward@debian.org |
| Distribution | unstable |
| Architecture | all |
| VCS | git: https://salsa.debian.org/homeassistant-team/js/node-idb-keyval.git (browse) |
| Tracker | https://tracker.debian.org/pkg/node-idb-keyval |
| Uploaded | 19 days ago |
New Package Report
.changes
| Changed-By | Edward Betts <edward@4angle.com> |
|---|---|
| Architecture | all source |
| Distribution | unstable |
| Date | Mon, 19 Oct 2026 13:19:30 +0100 |
| Source | node-idb-keyval |
| Version | 6.3.0-2 |
Changelog
node-idb-keyval (6.3.0-2) unstable; urgency=medium
.
* Correct copyright attribution for the Google size-report helper and
Debian-authored test code..dsc
| Section | javascript |
|---|---|
| Priority | optional |
| Component | main |
| Package-List | node-idb-keyval deb javascript optional arch=all |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: idb-keyval
Upstream-Contact: Jake Archibald
Source: https://github.com/jakearchibald/idb-keyval
Files: *
Copyright: 2016, Jake Archibald
License: Apache-2.0
Files: lib/size-report.js
Copyright: 2019 Google Inc.
License: Apache-2.0
Files: test/index.ts
Copyright: 2016, Jake Archibald
2026 Edward Betts <edward@4angle.com>
License: Apache-2.0
Files: debian/*
test/mocha.d.ts
test/type-checks.ts
Copyright: 2026 Edward Betts <edward@4angle.com>
License: Apache-2.0
License: Apache-2.0
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
http://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
.
On Debian systems, the complete text of the Apache 2.0 License
can be found in /usr/share/common-licenses/Apache-2.0 file.
DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 19 days ago.
Report
DFSG NEW review for node-idb-keyval version 6.3.0-2
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: Yes - Packaging is of good quality: Yes
- Issues: 0 blocker, 0 important, 0 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: nothing found
Licensing
The source is entirely Apache-2.0. The tree is small (21 upstream files, all read or grepped exhaustively): src/, test/, size-tests/, lib/, configs and docs are covered by the Files: * catch-all (2016 Jake Archibald, Apache-2.0). lib/size-report.js is correctly attributed to Google Inc. (header Copyright 2019 Google Inc. All Rights Reserved. with Apache-2.0). The Debian patch adds test/mocha.d.ts, test/type-checks.ts and modifications to test/index.ts, attributed to Edward Betts. Files: debian/* correctly covers the whole debian/ tree because the DEP-5 * wildcard crosses path separators (copyright-format 6.9). No non-free terms (no non-commercial / no-modification / field-of-use clauses), no built or minified or archived artifacts (dist/ is not in the tarball; the v6 CHANGELOG confirms it is no longer committed), no fonts/images/sounds, no embedded third-party copies. The stand-alone Apache-2.0 stanza gives the full text and points to /usr/share/common-licenses/Apache-2.0. All three copyright holders found in the tree are named in debian/copyright.
Packaging
Clean, standard pkg-js-tools packaging: debhelper-compat 14 with a plain dh $@ rules file, dh-sequence-nodejs-no-lerna and dh-sequence-single-binary, correct debian/nodejs/build (rollup -c) and a debian/nodejs/extlinks mapping of the npm modules used at build and test time. Every Build-Depends name was checked with apt-cache and exists; node-idb-keyval is genuinely new (the binary is built by this source, not already in the archive). Runtime Depends is only ${misc:Depends}, right for a browser library with no node runtime dependencies and harmless at compat 14. The autopkgtest suite is a real integration test: rollup-bundles test/index.ts and drives chromium headless against a local HTTP server doing real IndexedDB assertions, preceded by a tsc --noEmit type check; Testsuite: autopkgtest-pkg-nodejs (autodep8) brings the Build-Depends, incl. chromium/mocha/chai, into the test env, and test-only tools are marked <!nocheck>. Standards-Version 4.7.4 matches current Policy (4.7.4.1). Changelog and Vcs fields are sane. No policy violations, upgrade risks or missing named files found.
Issues
None.
Verified ◂
- debian/copyright read in full: DEP-5, 5 Files stanzas and stand-alone Apache-2.0 License stanza; precedence of stanzas matches copyright-format 6.9.
- Grep across the whole tree (excluding .pc/ and debian/) found licence text only in LICENCE, lib/size-report.js and a historical note in README.md; no file without a matching stanza and no hidden licence clause.
- All 21 files accounted for; no dist/, no minified/built/archive/font/image files; debian/clean lists
.ts-tmp/ dist/ tmp/. - Prescan author check: every holder (Jake Archibald, Google Inc., Edward Betts) is named in debian/copyright.
- All Build-Depends verified present in the archive via apt-cache; node-idb-keyval is built by this source and new to Debian.
- Standards-Version 4.7.4 matches current Policy; changelog, Vcs-* and autopkgtest setup read and consistent with pkg-js-tools conventions.
- uscan found the packaged version as the newest upstream release (upstream
6.3.0, packaged6.3.0). - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (Apache-2.0).
Not confirmed ◂
- No build or test execution was possible in this read-only review, so successful
rollup -cand the chromium autopkgtest run are assessed from the tree and reference tools, not observed.
Proposed changes ◂
None.
Uploader's response to the LLM review
The uploader was emailed about the review 19 days ago.
Review Information
rejected — allocated to babelouest 18 days ago, started 18 days ago, completed 18 days ago.
Final Comment
The d/copyright is inconsistent with the source code:
You're implying that the author of the files test/index.ts, test/mocha.d.ts and test/type-checks.ts are "2016, Jake ArchibaldW" and "2026 Edward Betts edward@4angle.com". I supposed it's because of the d/patches/dgit-changes file.
But in this case, the author of the source files test/index.ts, test/mocha.d.ts and test/type-checks.ts must remain the original author, and the additional author must be mentioned as the author of the d/patches/dgit-changes, n ot the files it patches.
Besindes, I don't see any changes in the file test/index.ts after applying the d/patches/dgit-changes file.