node-lingui 5.4.1-1

Package Information

Description	internationalization framework for JavaScript and TypeScript Lingui is a lightweight, open-source internationalization framework for JavaScript and TypeScript. It features compile-time macros and a command-line interface for message extraction and catalog compilation, supporting React, Node.js, and other modern frontend environments.
Maintainer	Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed By	Andrew Lee (李健秋) <ajqlee@debian.org>
Sponsor	ajqlee@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/js-team/node-js-lingui-workspaces.git (browse)
Closes	#1151000
Blocked Bugs	#1093255 (wishlist)
Tracker	https://tracker.debian.org/pkg/node-lingui
Uploaded	3 hours ago

New Package Report

.changes◂

Distribution	unstable
Date	Thu, 05 Nov 2026 14:22:19 +0100
Source	node-lingui
Version	5.4.1-1
Changed-By	Andrew Lee (李健秋) <ajqlee@debian.org>
Architecture	source all

Changelog◂

node-lingui (5.4.1-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1151000)

.dsc◂

Priority	optional
Component	main
Package-List	node-lingui deb javascript optional arch=all
Section	javascript

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: js-lingui
Upstream-Contact: https://github.com/lingui/js-lingui/issues
Source: https://github.com/lingui/js-lingui

Files: *
Copyright: 2017-2022 Tomáš Ehrlich
           2022-2023 Crowdin
License: Expat

Files: .yarn/releases/yarn-3.4.1.cjs
Copyright: 2014-present, Jon Schlinkert
           2015          Rebecca Turner
                         Joyent, Inc. and other Node contributors.
                         Node.js contributors
           2014          Blake Embrey <hello@blakeembrey.com>
License: Expat and ISC
Comment: Listed all the copyright holders from the minified cjs file.

Files: examples/rspack/*
Copyright: 2023 Collin Brown
License: Expat

Files: packages/detect-locale/*
       packages/remote-loader/*
Copyright: Sergio Moreno <sergiomorenoalbert@gmail.com>
License: Expat
Comment: author found from the package.json without list copyright year

Files: packages/metro-transformer/*
Copyright: Vojtech Novak <vonovak@gmail.com>
License: Expat
Comment: author found from the package.json without list copyright year

Files: packages/extractor-vue/*
Copyright: Christoffer Jahren <christoffer@jahren.it>
License: Expat
Comment: author found from the package.json without list copyright year

Files: debian/*
Copyright: Andrew Lee (李健秋) <ajqlee@debian.org>
License: Expat

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.

License: ISC
 Permission to use, copy, modify, and/or distribute this software for any
 purpose with or without fee is hereby granted, provided that the above
 copyright notice and this permission notice appear in all copies.
 .
 THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

DFSG Assistant LLM REVIEW 2 blocker, 3 important, 3 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 2 hours ago.

Report◂

DFSG NEW review for node-lingui version 5.4.1-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: No
Issues: 2 blocker, 3 important, 3 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 2 found

Licensing

The project's own code is MIT/Expat and debian/copyright is DEP-5, but it is not accurate for everything shipped: the source package carries two prebuilt, minified Yarn 3.4.1 bundles whose source is not in the package, and their stanza calls them Expat and ISC although Yarn is BSD-2-Clause, with no Yarn copyright holder and no BSD-2-Clause text, while the second bundle is not covered by any stanza but Files: *. One file copied from Babel also carries no Babel copyright holder. Everything else scanned (packages, examples, website, scripts, tests, .github) is Expat with holders that match the package.json authors.

Packaging

The build hook is a compile-only hack: it compiles every package with tsc (module esnext, no declarations) after masking missing modules with no-op stubs, so the installed tree contains dist/*.js where the packages' own package.json names dist/*.cjs/*.mjs/*.d.ts, and message-ID generation, PO support and ICU compilation are silently broken. Runtime dependencies are missing (Depends: nodejs:any only), the build-time test is jest || true, there is no autopkgtest, and the advertised lingui command is not installed.

Issues

blocker licensing 1. Source ships prebuilt minified Yarn 3.4.1 bundles with no source, and debian/copyright mislicenses them as Expat and ISC ◂

Files: .yarn/releases/yarn-3.4.1.cjs, .yarn/plugins/@yarnpkg/plugin-workspace-tools.cjs, .yarnrc.yml, debian/copyright:11-18
Basis: checked, in the package or with a reference tool
Evidence: Embedded manifest in the bundle: pWe.exports={name:"@yarnpkg/cli",version:"3.4.1",license:"BSD-2-Clause",...}; debian/copyright stanza: Files: .yarn/releases/yarn-3.4.1.cjs / Copyright: 2014-present, Jon Schlinkert ... / License: Expat and ISC. The plugin header is module.exports = { name: "@yarnpkg/plugin-workspace-tools", ...} and it is only covered by Files: * (License: Expat, holders Tomáš Ehrlich/Crowdin); its only notices are the MIT ones of bundled dependencies.
Problem: Neither file is the preferred form for modification: both are single-line minified bundles built from the Yarn sources (yarnpkg/berry), which are not in this package, so DFSG 2 is not met for them. Their licence is also misdeclared: Yarn is BSD-2-Clause, not Expat/ISC, the Yarn copyright holder is named nowhere, and the BSD-2-Clause text is absent (Policy 12.5 requires a verbatim copy). Debian already ships the same tool as node-yarnpkg 4.1.0, including node-yarnpkg-plugin-workspace-tools. The Debian build does not use .yarn at all: debian/nodejs/build runs tsc directly.
Fix: Repack the orig tarball without .yarn/ (add it to the filter in debian/gbp.conf and to Files-Excluded), and drop the yarnPath/plugins from .yarnrc.yml if it remains. If the bundles are kept, ship their sources and add a stanza with License: BSD-2-Clause, the Yarn Contributors copyright and the full BSD-2-Clause text, and cover the plugin too.

blocker licensing 2. packages/babel-plugin-lingui-macro/.../cleanJSXElementLiteralChild.ts is copied from Babel but debian/copyright names no Babel copyright holder ◂

Files: packages/babel-plugin-lingui-macro/src/utils/cleanJSXElementLiteralChild.ts:1, debian/copyright:6-9
Basis: inferred from what was read, not seen directly
Evidence: First line of the file: // taken from babel repo -> packages/babel-types/src/utils/react/cleanJSXElementLiteralChild.ts; the function matches Babel's implementation. /usr/share/doc/node-babel7/copyright states: Copyright: 2014-present, Sebastian McKenzie <sebmck@gmail.com> and License: Expat. debian/copyright's Files: * names only 2017-2022 Tomáš Ehrlich and 2022-2023 Crowdin.
Problem: Copied code keeps its original copyright; the MIT terms require the copyright notice to be preserved. debian/copyright describes this file as held only by the Lingui authors, which is inaccurate and does not reproduce the holder of the copied portion.
Fix: Add a Files: packages/babel-plugin-lingui-macro/src/utils/cleanJSXElementLiteralChild.ts stanza with Copyright: 2014-present, Sebastian McKenzie <sebmck@gmail.com> and other Babel contributors and License: Expat, or restore Babel's notice in the file and name the holder.

important packaging 3. tsc build emits ESM dist/.js but the installed package.json files name dist/.cjs, dist/.mjs and dist/.d.ts, which are never produced ◂

Files: debian/nodejs/build:60-80, packages/core/package.json:6-10, packages/conf/package.json:19-23, packages/cli/package.json:23-26, packages/message-utils/package.json:7-29, packages/react/package.json:5-9
Basis: checked, in the package or with a reference tool
Evidence: debian/nodejs/build writes each package's tsconfig with module: "esnext", outDir: "dist" and no declaration; tsc maps .ts to .js (getOutputExtension in /usr/share/nodejs/typescript/lib/typescript.js:121208-121210). Yet the shipped manifests say "main": "./dist/index.cjs", "module": "./dist/index.mjs", "types": "./dist/index.d.ts" (core, conf, react, format-po, babel plugins) and exports entries under ./dist/*.cjs/*.mjs (message-utils); the published packages also have no "type": "module", so even the cli's ./dist/index.js is loaded as CommonJS while it contains ESM.
Problem: The installed modules cannot be loaded: require/import resolves to files that do not exist, or to .js files that throw Cannot use import statement outside a module. The package is unusable as installed.
Fix: Build each package with upstream's own bundler (replacing unbuild with a packaged equivalent), or add build steps producing CommonJS .cjs, ESM .mjs and declaration files under the names the manifests use; alternatively patch the manifests to point at the emitted files and build CommonJS.

important packaging 4. debian/nodejs/build replaces real dependencies with no-op stubs, silently breaking message IDs, PO support, config loading and ICU compilation ◂

Files: debian/nodejs/build:9,20,31,42, packages/message-utils/src/generateMessageId.ts:3, packages/format-po/src/po.ts:132,264-275, packages/message-utils/src/compileMessage.ts:98, packages/conf/src/getConfig.ts:17-23
Basis: checked, in the package or with a reference tool
Evidence: l.includes("js-sha256") ? "const sha256 = (val) => val;"; l.includes("pofile") ? "const PO = {};" while the same file does new PO.Item() (po.ts:132) and PO.parse(content) (po.ts:265); the @messageformat/parser import is replaced by type Content = any; type Token = any; while return processTokens(parse(message), mapText) (compileMessage.ts:98) still calls it; the jiti loader still does require("jiti").
Problem: The shipped dist is not the upstream program: generateMessageId hashes nothing and returns IDs unrelated to upstream's SHA-256-based ones, the default PO formatter throws, ICU messages cannot be compiled, and the still-unresolved @messageformat/date-skeleton import makes the module fail at load time. These are silent, user-visible behaviour changes produced by the packaging.
Fix: Package the missing modules (js-sha256, pofile, jiti, @messageformat/parser and date-skeleton) as Build-Depends and drop the rewriting, or carry proper quilt patches that implement the substitution with equivalent behaviour; do not ship stubbed code.

important packaging 5. Depends lists only nodejs:any although the installed modules require many unpackaged Node modules at runtime ◂

Files: debian/control:34-36, packages/cli/package.json, packages/conf/package.json, packages/core/package.json
Basis: checked, in the package or with a reference tool
Evidence: Control: Package: node-lingui / Architecture: all / Depends: nodejs:any. @lingui/cli imports commander, chokidar, date-fns, picocolors, ora, glob, micromatch, normalize-path, esbuild, cli-table, pseudolocale, source-map, convert-source-map and @babel/*; @lingui/conf imports cosmiconfig, jest-validate, picocolors and require("jiti"); @lingui/core needs @babel/runtime. dh-sequence-nodejs adds only nodejs:any (Buildsystem/nodejs.pm:928) and, being a single-binary package, dh_nodejs_substvars exits without generating anything.
Problem: Debian node modules resolve bare specifiers from /usr/share/nodejs; none of these are installed by this package, so the CLI and the libraries fail with MODULE_NOT_FOUND. Policy 7.1 requires a package to depend on what it needs at runtime.
Fix: Add the corresponding packages to Depends (node-commander, node-chokidar, node-date-fns, node-picocolors, node-ora, node-glob, node-micromatch, node-cosmiconfig, node-jest-validate, node-babel7, esbuild, ...), and drop the modules whose dependencies cannot be provided in Debian.

minor packaging 6. The only test is jest || true, so dh_auto_test can never fail ◂

Files: debian/tests/pkg-js/test
Basis: checked, in the package or with a reference tool
Evidence:
```
#!/bin/bash

jest || true
```
Problem: dh_auto_test runs this file (Buildsystem/nodejs.pm, $testfile = ... 'debian/tests/pkg-js/test'), and the unconditional success makes the build-time test a no-op; any regression in the packages passes unnoticed.
Fix: Remove || true and fix or skip whatever fails, or delete the file so that dh_auto_test reports that it has nothing to run.

minor packaging 7. No autopkgtest: debian/tests/control is absent and the source package declares no Testsuite ◂

Files: debian/tests/, debian/control
Basis: checked, in the package or with a reference tool
Evidence: debian/tests contains only pkg-js/file and pkg-js/test; the .dsc has no Testsuite: field. The autopkgtest specification only provides implicit control files for Ruby and Perl packages.
Problem: With no debian/tests/control the pkg-js files are used only at build time, and nothing is run on ci.debian.net or in britney; a new package with an upstream test suite should have one.
Fix: Add Testsuite: autopkgtest-pkg-nodejs (or a debian/tests/control running the suite) so that the tests run under autopkgtest, after making them able to fail.

minor packaging 8. The advertised lingui command is not installed: no /usr/bin link is created ◂

Files: debian/rules:9-10, package.json, packages/cli/package.json:20-22
Basis: checked, in the package or with a reference tool
Evidence: dh-nodejs creates /usr/bin links only from the bin field of the main package.json (Buildsystem/nodejs.pm:868, auto_bin_links(..., $self->main_package, ...)); the root package.json has no bin field, while @lingui/cli declares "bin": { "lingui": "./dist/lingui.js" }. debian/rules:10 only does chmod +x .../@lingui/cli/dist/lingui.js and no debian/nodejs/bins or debian/links file exists.
Problem: The Description promises a command-line interface, and the chmod shows it is meant to be runnable, but nothing is put on PATH, so users cannot invoke lingui.
Fix: Add debian/nodejs/bins with lingui packages/cli/dist/lingui.js (or a debian/links entry /usr/bin/lingui ../share/nodejs/@lingui/cli/dist/lingui.js) and drop the now redundant chmod.

Verified ◂

debian/copyright read in full: DEP-5 with the correct Format URL, Files: *, five specific Files stanzas, debian/*, and stand-alone Expat and ISC texts; no Files-Excluded.
Whole tree except .pc/ and debian/cargo-checksum.json searched for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GPL/LGPL/Apache/MPL/CC/BSD/ISC wording, public domain, All rights reserved, and non-free wording (non-commercial, no modification, field-of-use); the only hit outside .yarn is the root LICENSE and examples/rspack/LICENSE (Expat, Collin Brown).
Every packages/*/package.json and examples/js/package.json declares license: MIT; the authors named in debian/copyright for detect-locale, remote-loader, metro-transformer and extractor-vue match their package.json author fields, as does the rspack example's LICENSE.
Prescan's holder check found every holder it could see already named in debian/copyright; no unreported holder turned up in the textual search.
Both .yarn files were inspected only at their headers and embedded metadata (they are single-line minified bundles); .yarnrc.yml shows they are the yarnPath and a plugin path. The Debian build never invokes yarn.
Binary assets recorded but not opened: website/static/img/.png and .svg, website/partner.svg, examples//public/.svg/.ico, examples/react-native/assets/*.png, examples/rspack/demo.gif. No font files are present in the tree.
packages/core/src/formats.ts marks ~15 lines of Intl option mapping as taken from messageformat; that is de minimis and under the same Expat licence, so no stanza was requested for it.
Debian files read in full: control, rules, changelog, copyright, gbp.conf, salsa-ci.yml, source/format, upstream/metadata and every file under debian/nodejs/ and debian/tests/pkg-js/.
Standards-Version 4.7.4 matches the reviewing system's Policy 4.7.4.1; debhelper compat 14 is current; the changelog is a well-formed initial unstable upload closing #1151000.
Build-Depends names checked with apt-cache: dh-sequence-single-binary (debhelper), node-babel-plugin-macros, node-husky, node-memory-fs, node-process, node-commander, node-chokidar, node-picocolors, esbuild and ts-jest all exist. node-pofile, node-js-sha256, node-jiti and node-messageformat-parser do not, which is why the build hook stubs them.
uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 6.12.0, packaged 5.4.1), which is not a fault of the package.

Not confirmed ◂

No build was run and no dist/ tree was available, so the conclusions about the emitted files come from reading debian/nodejs/build and TypeScript's own output-extension logic, not from built artefacts.
Whether cleanJSXElementLiteralChild.ts is a byte-for-byte copy of Babel's function was not compared, only its own header comment and the code.
CODE_OF_CONDUCT.md is an adaptation of the Contributor Covenant, whose own licence (CC BY 4.0) is stated neither in the file nor in debian/copyright; I did not treat it as a licence defect.
The provenance of the third-party brand logos under website/static/img/users/ (Brave, MetaMask, Bluesky, etc.) and the screenshots in website/static/img/ cannot be established from the package.

Proposed changes ◂

None.

Uploader's response to the LLM review

Waiting for the uploader's response until 2026-11-06 17:27 UTC, because the review found serious issues.

Back to Dashboard | View all reviews for this package