Review: node-idb-keyval 6.3.0-3
Package Information
| Description | promise-based key-value store using IndexedDB This library stores values using the browser's IndexedDB API. It supports retrieving, updating and deleting individual entries, batch operations, and listing keys, values or key-value pairs. Custom databases and object stores can be selected, and updates can be performed atomically. |
|---|---|
| Maintainer | Home Assistant Team <team+homeassistant@tracker.debian.org> |
| Changed By | Edward Betts <edward@4angle.com> |
| Sponsor | edward@debian.org |
| Distribution | unstable |
| Architecture | all |
| VCS | git: https://salsa.debian.org/homeassistant-team/js/node-idb-keyval.git (browse) |
| Tracker | https://tracker.debian.org/pkg/node-idb-keyval |
| Uploaded | 16 days ago |
New Package Report
.changes
| Date | Thu, 22 Oct 2026 13:07:43 +0100 |
|---|---|
| Source | node-idb-keyval |
| Version | 6.3.0-3 |
| Changed-By | Edward Betts <edward@4angle.com> |
| Architecture | all source |
| Distribution | unstable |
Changelog
node-idb-keyval (6.3.0-3) unstable; urgency=medium
.
* Remove test-file copyright overrides; the debian/* stanza already
covers the Debian patch..dsc
| Package-List | node-idb-keyval deb javascript optional arch=all |
|---|---|
| Section | javascript |
| Priority | optional |
| Component | main |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: idb-keyval
Upstream-Contact: Jake Archibald
Source: https://github.com/jakearchibald/idb-keyval
Files: *
Copyright: 2016, Jake Archibald
License: Apache-2.0
Files: lib/size-report.js
Copyright: 2019 Google Inc.
License: Apache-2.0
Files: debian/*
Copyright: 2026 Edward Betts <edward@4angle.com>
License: Apache-2.0
License: Apache-2.0
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
http://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
.
On Debian systems, the complete text of the Apache 2.0 License
can be found in /usr/share/common-licenses/Apache-2.0 file.
DFSG Assistant LLM REVIEW 0 blocker, 0 important, 1 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 16 days ago.
Report
DFSG NEW review for node-idb-keyval version 6.3.0-3
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: Yes - Packaging is of good quality: Yes
- Issues: 0 blocker, 0 important, 1 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: nothing found
Licensing
DFSG-compliant: the entire source is under the Apache License 2.0. debian/copyright is machine-readable DEP-5 with a correct Format line, a Files: * stanza (Jake Archibald, 2016, Apache-2.0), a lib/size-report.js stanza (2019 Google Inc., Apache-2.0), a debian/* stanza (2026 Edward Betts), and a full Apache-2.0 License paragraph pointing to /usr/share/common-licenses. The upstream LICENCE file carries the Apache-2.0 text, and package.json declares Apache-2.0. The prescan's author check found every holder named. No minified/compiled/binary artifacts are shipped: build outputs (dist/, .ts-tmp/, tmp/) are excluded by debian/clean. Only a minor attribution inaccuracy remains (see issue).
Packaging
Quality packaging: debhelper compat 14 with dh $@, Architecture: all for a pure-JS library, correct Section, Homepage, Vcs-Browser/Vcs-Git, and Standards-Version 4.7.4. Build-Depends (debhelper-compat 14, dh-nodejs, dh-sequence-*, rollup and plugins, mocha/chai/chromium with < !nocheck >) are appropriate; at compat 14 the single binary's ${misc:Depends} is sufficient (no shlibs needed). Changelog is sane and closes #1151234; the 6.3.0-1/2/3 history matches the tree. A real autopkgtest (tests/pkg-js) compiles with tsc and runs the upstream suite in a headless-Chromium IndexedDB via run-tests.cjs, expecting 34 passing tests. patches/dgit-changes is the standard single combined dgit patch with a descriptive subject; debian/source/format is 3.0 (quilt). No policy violations or upgrade problems found.
Issues
minor
licensing
1. Debian-patch-added test files fall under the upstream Files: * stanza
◂
- Files:
test/type-checks.ts, test/mocha.d.ts; debian/copyright (Files: *) - Basis: checked, in the package or with a reference tool
- Evidence:
debian/patches/dgit-changesaddstest/type-checks.tsandtest/mocha.d.ts. Neither is underdebian/, so thedebian/*stanza does not match them; they are covered byFiles: *(Copyright: 2016, Jake Archibald). The 6.3.0-3 changelog claimsthe debian/* stanza already covers the Debian patch, but that pattern does not reach files undertest/. - Problem:
debian/copyrightattributes the two Debian-authored test files to upstream Jake Archibald (2016) rather than the Debian maintainer who wrote them, so the copyright line for those files is not accurate. - Fix: Add a stanza for
test/type-checks.tsandtest/mocha.d.ts(or the Debian-patch-added files) crediting the Debian maintainer, e.g.Copyright: 2026 Edward Betts; licence stays Apache-2.0.
Verified ◂
- All 21 source files reviewed; every file is covered by a
Files:stanza in the DEP-5debian/copyright. - Entire tree is Apache-2.0; upstream
LICENCEand package.jsonlicensefield agree; no other licence text present anywhere (grep for BSD/MIT/GPL/LGPL/MPL/ISC/COPYING/NOTICE found none). lib/size-report.jscorrectly matched to its Google Inc. header by its own stanza.- Build artifacts (
dist/,.ts-tmp/,tmp/) named indebian/cleanare absent from the shipped source; no minified, compiled, or binary files in the tree. - prescan author check: every holder found is named in
debian/copyright(Jake Archibald, Google Inc., Edward Betts). debian/copyrightFormat line is the exact copyright-format 1.0 URL and the Apache-2.0 common-licenses pointer is valid.debian/controlfields (Build-Depends, Depends${misc:Depends}, Standards-Version 4.7.4, Vcs-*, Testsuite autopkgtest-pkg-nodejs) are consistent at compat 14.- autopkgtest
debian/tests/pkg-jscompiles tests with tsc and runs them in real IndexedDB via Chromium. - Changelog versions 6.3.0-1..-3, closing #1151234, distribution unstable; matches the changes described in
dgit-changes. - uscan found the packaged version as the newest upstream release (upstream
6.3.0, packaged6.3.0). - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (Apache-2.0).
Not confirmed ◂
None.
Proposed changes ◂
None.
Uploader's response to the LLM review
The uploader was emailed about the review 16 days ago.
Review Information
accepted — allocated to babelouest 15 days ago, started 15 days ago, completed 15 days ago.