Review: node-idb-keyval 6.3.0-3

Package Information

Description	promise-based key-value store using IndexedDB This library stores values using the browser's IndexedDB API. It supports retrieving, updating and deleting individual entries, batch operations, and listing keys, values or key-value pairs. Custom databases and object stores can be selected, and updates can be performed atomically.
Maintainer	Home Assistant Team <team+homeassistant@tracker.debian.org>
Changed By	Edward Betts <edward@4angle.com>
Sponsor	edward@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/homeassistant-team/js/node-idb-keyval.git (browse)
Tracker	https://tracker.debian.org/pkg/node-idb-keyval
Uploaded	16 days ago

New Package Report

.changes◂

Source	node-idb-keyval
Version	6.3.0-3
Changed-By	Edward Betts <edward@4angle.com>
Architecture	all source
Distribution	unstable
Date	Thu, 22 Oct 2026 13:07:43 +0100

Changelog◂

node-idb-keyval (6.3.0-3) unstable; urgency=medium
 .
   * Remove test-file copyright overrides; the debian/* stanza already
     covers the Debian patch.

.dsc◂

Section	javascript
Priority	optional
Component	main
Package-List	node-idb-keyval deb javascript optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: idb-keyval
Upstream-Contact: Jake Archibald
Source: https://github.com/jakearchibald/idb-keyval

Files: *
Copyright: 2016, Jake Archibald
License: Apache-2.0

Files: lib/size-report.js
Copyright: 2019 Google Inc.
License: Apache-2.0

Files: debian/*
Copyright: 2026 Edward Betts <edward@4angle.com>
License: Apache-2.0


License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
      http://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the complete text of the Apache 2.0 License
 can be found in /usr/share/common-licenses/Apache-2.0 file.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 16 days ago.

Report◂

DFSG NEW review for node-idb-keyval version 6.3.0-3

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 1 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

DFSG-compliant: the entire source is under the Apache License 2.0. debian/copyright is machine-readable DEP-5 with a correct Format line, a Files: * stanza (Jake Archibald, 2016, Apache-2.0), a lib/size-report.js stanza (2019 Google Inc., Apache-2.0), a debian/* stanza (2026 Edward Betts), and a full Apache-2.0 License paragraph pointing to /usr/share/common-licenses. The upstream LICENCE file carries the Apache-2.0 text, and package.json declares Apache-2.0. The prescan's author check found every holder named. No minified/compiled/binary artifacts are shipped: build outputs (dist/, .ts-tmp/, tmp/) are excluded by debian/clean. Only a minor attribution inaccuracy remains (see issue).

Packaging

Quality packaging: debhelper compat 14 with dh $@, Architecture: all for a pure-JS library, correct Section, Homepage, Vcs-Browser/Vcs-Git, and Standards-Version 4.7.4. Build-Depends (debhelper-compat 14, dh-nodejs, dh-sequence-*, rollup and plugins, mocha/chai/chromium with < !nocheck >) are appropriate; at compat 14 the single binary's ${misc:Depends} is sufficient (no shlibs needed). Changelog is sane and closes #1151234; the 6.3.0-1/2/3 history matches the tree. A real autopkgtest (tests/pkg-js) compiles with tsc and runs the upstream suite in a headless-Chromium IndexedDB via run-tests.cjs, expecting 34 passing tests. patches/dgit-changes is the standard single combined dgit patch with a descriptive subject; debian/source/format is 3.0 (quilt). No policy violations or upgrade problems found.

Issues

minor licensing 1. Debian-patch-added test files fall under the upstream Files: * stanza ◂

Files: test/type-checks.ts, test/mocha.d.ts; debian/copyright (Files: *)
Basis: checked, in the package or with a reference tool
Evidence: debian/patches/dgit-changes adds test/type-checks.ts and test/mocha.d.ts. Neither is under debian/, so the debian/* stanza does not match them; they are covered by Files: * (Copyright: 2016, Jake Archibald). The 6.3.0-3 changelog claims the debian/* stanza already covers the Debian patch, but that pattern does not reach files under test/.
Problem: debian/copyright attributes the two Debian-authored test files to upstream Jake Archibald (2016) rather than the Debian maintainer who wrote them, so the copyright line for those files is not accurate.
Fix: Add a stanza for test/type-checks.ts and test/mocha.d.ts (or the Debian-patch-added files) crediting the Debian maintainer, e.g. Copyright: 2026 Edward Betts; licence stays Apache-2.0.

Verified ◂

All 21 source files reviewed; every file is covered by a Files: stanza in the DEP-5 debian/copyright.
Entire tree is Apache-2.0; upstream LICENCE and package.json license field agree; no other licence text present anywhere (grep for BSD/MIT/GPL/LGPL/MPL/ISC/COPYING/NOTICE found none).
lib/size-report.js correctly matched to its Google Inc. header by its own stanza.
Build artifacts (dist/, .ts-tmp/, tmp/) named in debian/clean are absent from the shipped source; no minified, compiled, or binary files in the tree.
prescan author check: every holder found is named in debian/copyright (Jake Archibald, Google Inc., Edward Betts).
debian/copyright Format line is the exact copyright-format 1.0 URL and the Apache-2.0 common-licenses pointer is valid.
debian/control fields (Build-Depends, Depends ${misc:Depends}, Standards-Version 4.7.4, Vcs-*, Testsuite autopkgtest-pkg-nodejs) are consistent at compat 14.
autopkgtest debian/tests/pkg-js compiles tests with tsc and runs them in real IndexedDB via Chromium.
Changelog versions 6.3.0-1..-3, closing #1151234, distribution unstable; matches the changes described in dgit-changes.
uscan found the packaged version as the newest upstream release (upstream 6.3.0, packaged 6.3.0).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

None.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 16 days ago.

Review Information

accepted — allocated to babelouest 15 days ago, started 15 days ago, completed 15 days ago.

Final Comment

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
6.3.0-2	0f65a0b5…	2026-10-21 00:08	2026-10-21 00:14	babelouest	rejected	VIEW
6.3.0-1	1532802f…	2026-10-19 12:21	2026-10-19 12:21	dfsg-uploader	rejected	VIEW

Back to Dashboard | View all reviews for this package