Review: node-lezer-yaml 1.0.4-1

Package Information

Description	Node.js module to provide YAML grammar for the lezer parser system The problem of parsing structured text has resisted one-size-fits all solutions for over 60 years. Lezer isn't such a solution either, but it is a very decent parser generator, especially well suited for use in code editors. This package provides a YAML grammar for the Lezer parser system.
Maintainer	Home Assistant Team <team+homeassistant@tracker.debian.org>
Changed By	Edward Betts <edward@4angle.com>
Sponsor	edward@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/homeassistant-team/js/node-lezer-yaml.git (browse)
Closes	#1152185
Tracker	https://tracker.debian.org/pkg/node-lezer-yaml
Uploaded	12 days ago

New Package Report

.changes◂

Version	1.0.4-1
Changed-By	Edward Betts <edward@4angle.com>
Architecture	all source
Distribution	unstable
Date	Mon, 26 Oct 2026 16:20:41 +0000
Source	node-lezer-yaml

Changelog◂

node-lezer-yaml (1.0.4-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1152185)

.dsc◂

Priority	optional
Component	main
Package-List	node-lezer-yaml deb javascript optional arch=all
Section	javascript

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: @lezer/yaml
Upstream-Contact: Marijn Haverbeke <marijnh@gmail.com>
Source: https://github.com/lezer-parser/yaml

Files: *
Copyright: 2024 Marijn Haverbeke <marijnh@gmail.com> and others
License: MIT

Files: debian/*
Copyright: 2026 Edward Betts <edward@4angle.com>
License: MIT

License: MIT
 Permission is hereby granted, free of charge, to any person obtaining a
 copy of this software and associated documentation files (the "Software"),
 to deal in the Software without restriction, including without limitation
 the rights to use, copy, modify, merge, publish, distribute, sublicense,
 and/or sell copies of the Software, and to permit persons to whom the
 Software is furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 DEALINGS IN THE SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 11 days ago.

Report◂

DFSG NEW review for node-lezer-yaml version 1.0.4-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The whole upstream tree is MIT-licensed: the top-level LICENSE reproduces the MIT text naming Marijn Haverbeke and others, package.json declares MIT, and no other copyright or licence notice exists in any of the 14 upstream files (all of src/, test/, dist/index.d.cts, dist/index.d.ts, README.md, CHANGELOG.md, package.json, rollup.config.js and the dotfiles). debian/copyright is DEP-5, has the correct Format URL, a Files: * stanza matching the holder and year in LICENSE, a later debian/* stanza for Edward Betts, and a stand-alone License paragraph with the full MIT text (MIT is not in /usr/share/common-licenses, so that text is required). The scan before the review listed no files and its author check found every holder named; test data carries no separate notice. No non-free terms, binaries, minified code, vendored third-party code or generated files without their sources are present: src/yaml.grammar and the hand-written src/.js generate src/parser.js and dist/index.{js,cjs} at build time, which debian/clean removes.

Packaging

The packaging is small and correct for a pkg-js-tools/node module: debian/rules is the standard dh invocation at compat 14, debian/nodejs/build uses a small offline rollup/lezer-generator script, debian/nodejs/files installs dist plus package.json (whose main/exports/types all point at dist files that are built), and debian/nodejs/extlinks resolves every bare import of the build and test (@lezer/generator, @lezer/common, @lezer/highlight, @lezer/lr) to packages present in Build-Depends. Every Build-Depends name exists (dh-nodejs provides dh-sequence-nodejs-no-lerna, debhelper 14.5 provides dh-sequence-single-binary, and node-lezer-common provides @lezer/lr 1.4.8 and @lezer/highlight 1.2.3, satisfying the upstream ^1.4.0/^1.0.0 imports). Standards-Version 4.7.4 has the same first two components as current Policy 4.7.4.1. The build-time test is the upstream mocha suite with mocha <!nocheck>, which dh skips at compat 14 under nocheck; the same suite is wired for autopkgtest-pkg-nodejs via debian/tests/pkg-js. Changelog, Vcs-*, Homepage, upstream metadata and Multi-Arch: foreign are all appropriate, and there are no patches or maintainer scripts to review.

Issues

None.

Verified ◂

Read every file in the package (14 upstream files plus all of debian/ except debian/watch, which is out of scope) and the .dsc and both tarball listings; the orig tarball contains exactly the upstream tree, including dist/index.d.cts and dist/index.d.ts.
LICENSE (MIT, 'Copyright (C) 2024 by Marijn Haverbeke marijnh@gmail.com and others') and package.json ('license': 'MIT') are the only licence declarations; a tree-wide grep for Copyright/(C)/©/SPDX/Licensed under/permission/GNU/Apache/MPL/public domain/all rights reserved found nothing else.
debian/copyright: DEP-5, exact Format URL, Files: * -> 2024 Marijn Haverbeke and others, MIT; later Files: debian/* -> 2026 Edward Betts, MIT; full MIT text in the stand-alone License paragraph. Matches LICENSE word for word in substance and year.
The scan listed no files. Its author check found two holders (Marijn Haverbeke, Edward Betts) and both are named in debian/copyright; there is no unaccounted holdername in the tree.
test/spec.txt and test/basics.txt are hand-maintained upstream lezer test cases (YAML snippets plus expected parse trees); they carry no separate copyright or licence notice and are covered by the top-level MIT LICENSE.
Generated files are not shipped: src/parser.js, src/parser.terms.js, dist/index.js and dist/index.cjs are produced by debian/build.cjs from src/yaml.grammar and the hand-written src/tokens.js and src/highlight.js, and are all listed in debian/clean. The only dist files in the tree, index.d.cts and index.d.ts, are hand-written 66-byte type declarations, not build output.
No binary, minified, archive, font, image or firmware files; no .jar/.class/.so/.pyc and no node_modules or vendored copies of third-party code.
Build-Depends checked against the archive with apt-cache: dh-nodejs 0.17.14 (Provides dh-sequence-nodejs-no-lerna), debhelper 14.5 (Provides dh-sequence-single-binary), node-lezer-generator 1.8.0, node-lezer-common 1.5.2 (Provides node-lezer-lr = 1.4.8 and node-lezer-highlight = 1.2.3), node-rollup-plugin-node-resolve 15.2.3, rollup 3.30.0, mocha 12.0.3.
debian/nodejs/files contains 'dist'; dh's nodejs build system installs that directory plus package.json into /usr/share/nodejs/@lezer/yaml, and package.json main (dist/index.cjs), exports (dist/index.js, dist/index.cjs) and types (dist/index.d.ts) name installed files.
debian/nodejs/extlinks lists the four bare module imports (@lezer/generator, @lezer/common, @lezer/highlight, @lezer/lr); the second three are provided by the declared Build-Depends node-lezer-common and the first by node-lezer-generator, so the dh-nodejs configure-time link step has all of them.
debian/tests/pkg-js/test runs the upstream mocha suite (mocha test/test-yaml.js) with test/ listed in debian/tests/pkg-js/files; Testsuite: autopkgtest-pkg-nodejs is set. mocha is marked <!nocheck> in Build-Depends, and at debhelper compat 14 dh skips dh_auto_test under nocheck (checked with the debhelper tool).
Standards-Version 4.7.4 against Policy 4.7.4.1 (policy tool): first two components match, so not an issue. debhelper-compat (= 14) is a valid current level.
No debian/patches, no maintainer scripts, no *.maintscript; source format 3.0 (quilt) with no patches is consistent.
Changelog is a single well-formed initial-release entry for unstable closing #1152185; Vcs-Git/Vcs-Browser/Homepage are consistent with the upstream repository.
uscan found the packaged version as the newest upstream release (upstream 1.0.4, packaged 1.0.4).

Not confirmed ◂

pkg-js-autopkgtest (the Testsuite runner) and the node-lezer-* modules are not installed on the reviewing system, so the autopkgtest runner's handling of debian/tests/pkg-js/files and the test's relative import of ../dist/index.js could not be exercised; the build-time run of the identical script does have the built dist present.
The existence of the subpath @lezer/generator/dist/test used by test/test-yaml.js could not be checked because node-lezer-generator is not installed here (the package itself is in the archive).
test/spec.txt reproduces example titles and YAML snippets from the YAML specification referenced by README.md, and carries no notice of its own; the YAML specification's own licence was not reachable from the package or the reviewing system, so its possible attribution requirement was not checked.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 11 days ago.

Review Information

accepted — allocated to babelouest 11 days ago, started 11 days ago, completed 11 days ago.

Final Comment

Back to Dashboard | View all reviews for this package