DFSG NEW review for node-jsdom-global version 3.0.2-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 with a correct Format line. Files: * (Expat, Rico Sta. Cruz, 2016-2017) covers all ten upstream files, and debian/* (Edward Betts, 2026) covers the packaging; the full Expat text is included, as the licence is not in /usr/share/common-licenses. Upstream ships no LICENSE file, but package.json says "MIT" and README.md says MIT, both consistent with the Expat stanza. A grep of the whole upstream tree for copyright and licence wording found only README.md:133, which names the same holder as Files: *. No third-party or vendored code, no non-free terms, no built or minified files, and nothing that lacks its source.

Packaging

Small, conventional pkg-js-tools package: debhelper compat 14, dh-nodejs with the nodejs_no_lerna and single_binary sequences, correct Depends on node-jsdom (>= 10) matching the upstream peer dependency, node-jsdom and node-tape as <!nocheck> build dependencies for the upstream tape test, and an autopkgtest through Testsuite: autopkgtest-pkg-nodejs with debian/tests/pkg-js/test. The one Debian patch is the dgit combined delta and does what it says (test.js requires the installed module). Changelog is a well-formed initial release closing the ITP, and the Vcs-*, Homepage and upstream/metadata fields agree with upstream.

Issues

None.

Verified

• debian/copyright is machine-readable (DEP-5); I read it in full. Files: * is Copyright: 2016-2017 Rico Sta. Cruz <rico@ricostacruz.com> / License: Expat, Files: debian/* is 2026 Edward Betts, and the stand-alone Expat paragraph has the complete MIT/Expat text, needed because Expat is not in /usr/share/common-licenses.
• Prescan item README.md:133 (**jsdom-global** © 2016+, Rico Sta. Cruz. Released under the [MIT] License.): the holder is the one Files: * names; only the year range differs (README says 2016+, copyright says 2016-2017), which is not a licensing fault. package.json also records "author": "Rico Sta. Cruz <rico@ricostacruz.com>" and "license": "MIT".
• keys.js:1 says // See jsdom's lib/jsdom/living/index.js. The file is a hand-written list of DOM/WebIDL interface and window property names (no copied implementation code); names of standard interfaces are facts, and jsdom is MIT anyway, so no extra holder or stanza is needed.
• Files inventoried: the orig tarball holds exactly .gitignore, .travis.yml, HISTORY.md, README.md, browser.js, index.js, keys.js, package.json, register.js, test.js — the ten files in the tree; the debian.tar.xz holds exactly the debian/ files reviewed. No LICENSE/COPYING/NOTICE/AUTHORS file exists upstream, and none is needed since the licence text is in debian/copyright.
• Grep over the upstream files for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU , Apache License, Mozilla Public, public domain, All rights reserved found only the README.md:133 line already accounted for; no file carries a conflicting or additional licence.
• The prescan reported no built programs, minified code, archives, PDFs or non-free wording; the only script-like files are the five small JS sources and the two CI/config files (.travis.yml, .gitignore), all plain text.
• debian/patches/dgit-changes is dgit's combined delta; its only hunk changes require('./index') to require('jsdom-global') in test.js, which is what the installed module and the autopkgtest need. debian/patches/series lists it and .pc/applied-patches confirms it is applied.
• Read /usr/share/perl5/Debian/Debhelper/Buildsystem/nodejs.pm: install copies to /usr/share/nodejs/<package.json name>, i.e. /usr/share/nodejs/jsdom-global, matching the module name the patched test.js requires; test runs debian/tests/pkg-js/test, so the build-time run of node test.js uses node-tape and node-jsdom from Build-Depends. Read Sequence/nodejs_no_lerna.pm and Sequence/single_binary.pm; both exist in debhelper/dh-nodejs and are compatible with this one-binary package.
• debian/control: Build-Depends dh-nodejs, dh-sequence-nodejs-no-lerna (provided by dh-nodejs 0.17.14) and dh-sequence-single-binary (provided by debhelper 14.5) all resolve; Standards-Version 4.7.4 has the first two components of the current Policy 4.7.4.1, so it is not an issue.
• debian/changelog: node-jsdom-global (3.0.2-1) unstable; urgency=medium, initial release closing #1152483, dated Thu, 29 Oct 2026 (a Thursday), matching the 3.0.2 upstream version.
• debian/upstream/metadata and debian/control Homepage/Vcs-* all point at rstacruz/jsdom-global and the salsa homeassistant-team repository consistently; debian/node-jsdom-global.docs installs README.md.
• uscan found the packaged version as the newest upstream release (upstream 3.0.2, packaged 3.0.2).

Not confirmed

• Testsuite: autopkgtest-pkg-nodejs relies on the implicit control file of pkg-js-tools, which is not installed on this reviewing system, so I could not read which dependencies the autopkgtest installs. The test needs node-tape besides the package itself; if the implicit control does not include the build dependencies (as the Ruby one does with @builddeps@), the autopkgtest would fail on require('tape'). This does not affect the build, which runs the same test with node-tape from Build-Depends.

Proposed changes

None.