Review: node-lingui 5.4.1+ds-1

Package Information

Description	internationalization framework for JavaScript and TypeScript Lingui is a lightweight, open-source internationalization framework for JavaScript and TypeScript. It features compile-time macros and a command-line interface for message extraction and catalog compilation, supporting React, Node.js, and other modern frontend environments.
Maintainer	Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed By	Andrew Lee (李健秋) <ajqlee@debian.org>
Sponsor	ajqlee@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/js-team/node-js-lingui-workspaces.git (browse)
Closes	#1151000
Blocked Bugs	#1093255 (wishlist)
Tracker	https://tracker.debian.org/pkg/node-lingui
Uploaded	1 day ago
Supersedes	5.4.1-1

New Package Report

.changes◂

Architecture	source all
Distribution	unstable
Date	Thu, 05 Nov 2026 14:22:19 +0100
Source	node-lingui
Version	5.4.1+ds-1
Changed-By	Andrew Lee (李健秋) <ajqlee@debian.org>

Changelog◂

node-lingui (5.4.1+ds-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1151000)

.dsc◂

Priority	optional
Component	main
Package-List	node-lingui deb javascript optional arch=all
Section	javascript

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: js-lingui
Upstream-Contact: https://github.com/lingui/js-lingui/issues
Source: https://github.com/lingui/js-lingui
Files-Excluded:
 .yarn
 website

Files: *
Copyright: 2017-2022 Tomáš Ehrlich
           2022-2023 Crowdin
License: Expat

Files: packages/babel-plugin-lingui-macro/src/utils/cleanJSXElementLiteralChild.ts
Copyright: 2014-present Sebastian McKenzie and other contributors
License: Expat
Comment: taken from babel with copyright info from babel

Files: examples/rspack/*
Copyright: 2023 Collin Brown
License: Expat

Files: packages/detect-locale/*
       packages/remote-loader/*
Copyright: Sergio Moreno <sergiomorenoalbert@gmail.com>
License: Expat
Comment: author found from the package.json without list copyright year

Files: packages/metro-transformer/*
Copyright: Vojtech Novak <vonovak@gmail.com>
License: Expat
Comment: author found from the package.json without list copyright year

Files: packages/extractor-vue/*
Copyright: Christoffer Jahren <christoffer@jahren.it>
License: Expat
Comment: author found from the package.json without list copyright year

Files: debian/*
Copyright: Andrew Lee (李健秋) <ajqlee@debian.org>
License: Expat

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.

License: ISC
 Permission to use, copy, modify, and/or distribute this software for any
 purpose with or without fee is hereby granted, provided that the above
 copyright notice and this permission notice appear in all copies.
 .
 THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

DFSG Assistant LLM REVIEW 1 blocker, 4 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 day ago.

Report◂

DFSG NEW review for node-lingui version 5.4.1+ds-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: No
Issues: 1 blocker, 4 important, 1 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

All licences in the tree are MIT/Expat and DFSG-free: the top-level LICENSE, examples/rspack/LICENSE and every package.json say MIT, and a grep of the whole tree found no GPL, Apache, CC, non-commercial or no-modification wording. debian/copyright is valid DEP-5 with correct licence text and stanzas matching the four contributed packages. It is not accurate for every file, however: packages/metro-transformer/src/types.ts says itself that it is taken from facebook/metro, yet its stanza names only Vojtech Novak, and the Create React App template files in examples/create-react-app are credited to Tomáš Ehrlich/Crowdin. Those attributions need fixing before the copyright file is accurate.

Packaging

The custom debian/nodejs/build replaces upstream's unbuild/tsc builds with one generic tsc pass whose output does not match the installed manifests (exports/main/bin name dist/.cjs and dist/.mjs; tsc writes dist/*.js and keeps JSX), and it stubs or leaves unresolved runtime libraries Debian does not have (pofile, js-sha256, @messageformat/parser, pseudolocale, jiti), so the installed modules and the lingui CLI cannot be loaded or do their job. The autopkgtests in debian/tests/pkg-js are not registered (no Testsuite field) and end in jest || true, so nothing in the archive would notice any of this.

Issues

blocker licensing 1. Files: packages/metro-transformer/* names only Vojtech Novak although src/types.ts is copied from facebook/metro ◂

Files: packages/metro-transformer/src/types.ts:1-2, debian/copyright (Files: packages/metro-transformer/*)
Basis: checked, in the package or with a reference tool
Evidence: types.ts begins // taken and redacted (removed unnecessary parts) from / // https://github.com/facebook/metro/blob/main/packages/metro-transformer/types/index.d.ts, while the stanza has Copyright: Vojtech Novak <vonovak@gmail.com> and License: Expat only.
Problem: The file is metro's code (Meta Platforms, Inc. and affiliates, MIT), so the Expat notice it is under must be reproduced and its holder named. No Facebook/Meta holder appears anywhere in debian/copyright: Files: * names only Tomáš Ehrlich and Crowdin. packages/metro-transformer is installed in the binary, so the inaccuracy concerns shipped code.
Fix: Add a stanza, before the metro-transformer one, such as Files: packages/metro-transformer/src/types.ts with Copyright: Meta Platforms, Inc. and affiliates and License: Expat.

important licensing 2. Files: * credits the Create React App template files in examples/create-react-app to Tomáš Ehrlich and Crowdin instead of their author ◂

Files: examples/create-react-app/public/index.html:9, examples/create-react-app/src/serviceWorker.ts:1-12, examples/create-react-app/src/App.css, examples/create-react-app/src/index.css, examples/create-react-app/src/logo.svg, debian/copyright (Files: *)
Basis: inferred from what was read, not seen directly
Evidence: README.md says This project was bootstrapped with [Create React App](https://github.com/facebook/create-react-app), index.html has <meta name="description" content="Web site created using create-react-app" />, and serviceWorker.ts is CRA's generated service-worker boilerplate (comments link to facebook/create-react-app and bit.ly/CRA-PWA). copyright has Copyright: 2017-2022 Tomáš Ehrlich / 2022-2023 Crowdin.
Problem: These files are Create React App's template output, which is Facebook's code under the MIT licence (Copyright (c) 2013-present, Facebook, Inc.); Files: * attributes them to Lingui's holders and no CRA holder is named anywhere in the file, so debian/copyright is inaccurate for them.
Fix: Add Files: examples/create-react-app/* with Copyright: 2013-present Facebook, Inc. and License: Expat (the standalone Expat paragraph is there), or drop the example in the +ds repack.

important packaging 3. debian/nodejs/build's generic tsc pass cannot produce the entry points the installed package.json files declare ◂

Files: debian/nodejs/build, packages/core/package.json:6-7,41-48, packages/react/package.json:6-7, packages/message-utils/compileMessage.js:6, packages/metro-transformer/package.json:7-13, packages/cli/package.json (bin and exports), packages/core/src/index.ts:1-3
Basis: inferred from what was read, not seen directly
Evidence: The build script writes each package the same tsconfig ("module": "esnext", "jsx": "preserve", "outDir": "dist") and runs tsc; afterwards it rewrites only main, module and types (pkg.main.replace(/\.cjs$/, ".js")) and leaves exports untouched. packages/core/package.json still declares "default": "./dist/index.cjs" under require and "./dist/index.mjs" under import, message-utils/compileMessage.js still does require("./dist/compileMessage.cjs"), and core's sources import relatively without extensions (export { setupI18n } from "./i18n").
Problem: tsc emits dist/<source>.js (so dist/index.cjs and dist/index.mjs are never created) and copies ESM syntax with extensionless relative imports, which Node cannot resolve. The installed packages therefore throw MODULE_NOT_FOUND for their own entry points (Node honours exports over the rewritten main), packages/react's dist keeps JSX because of "jsx": "preserve", and the CLI's dist/lingui.js uses __dirname. Unbuild, which upstream uses and which produces the .cjs/.mjs files, is not packaged or invoked.
Fix: Build with upstream's build system (package unbuild, or a tsc invocation that emits the .cjs/.mjs names and a loadable module format and rewrites all of main/module/types/exports), and smoke-test require() and import of every installed module before upload.

important packaging 4. Build stubs or leaves unresolved runtime libraries, so PO catalogs, message IDs, message compilation and the CLI are broken ◂

Files: debian/nodejs/build, packages/format-po/src/po.ts:132,265,275, packages/message-utils/src/generateMessageId.ts:1-7, packages/message-utils/src/compileMessage.ts:1-12, packages/cli/src/api/pseudoLocalize.ts:1,55, packages/conf/src/getConfig.ts:20-27
Basis: checked, in the package or with a reference tool
Evidence: debian/nodejs/build replaces every line containing pofile with const PO = {}; and every line containing js-sha256 with const sha256 = (val) => val;. compileMessage.ts still begins import { Content, parse, Token } from "@messageformat/parser" (the script's substitution requires a trailing ;, and this semicolon-free file has none), getConfig.ts calls require("jiti"), and pseudoLocalize.ts does import pseudolocale from "pseudolocale". apt-cache has no node-pofile, node-pseudolocale, node-jiti or node-messageformat-parser.
Problem: PO.parse(content) and new PO() in format-po throw, so no PO catalog can be read or written; the identity sha256 makes generateMessageId base64 the unhashed message (ids collide, and btoa throws for non-Latin-1 messages); compileMessage's parse(...) is a missing module, and @lingui/cli and config loading fail on import for pseudolocale and jiti. Silently rewriting sources to a stub hides the unpackaged dependencies instead of packaging them.
Fix: Package the missing libraries (pofile, js-sha256, @messageformat/parser, pseudolocale, jiti) or omit the features that need them, and remove the source rewriting from debian/nodejs/build.

important packaging 5. The autopkgtest in debian/tests/pkg-js is never run: no Testsuite field and no debian/tests/control ◂

Files: debian/control, debian/tests/pkg-js/test, debian/tests/pkg-js/file
Basis: checked, in the package or with a reference tool
Evidence: debian/control has no Testsuite: field and there is no debian/tests/control; the pkg-js-autopkgtest package description says Simply set "Testsuite: autopkgtest-pkg-nodejs" in debian/control to use it.
Problem: The debian/tests/pkg-js/{file,test} pair is only picked up through that interface; without the field or a tests/control file autopkgtest finds no test at all, so the archive runs nothing on this package (Policy 4.9, autopkgtest specification).
Fix: Add Testsuite: autopkgtest-pkg-nodejs to the source stanza of debian/control.

minor packaging 6. debian/tests/pkg-js/test runs jest || true, so the test can never fail ◂

Files: debian/tests/pkg-js/test:3
Basis: checked, in the package or with a reference tool
Evidence: The whole script is #!/bin/bash, jest || true; the nodejs buildsystem also runs this same file as the build's test step (sub test in /usr/share/perl5/Debian/Debhelper/Buildsystem/nodejs.pm).
Problem: A test that always exits 0 covers nothing at build time or in autopkgtest; it masks the missing dist entry points above. It is doubly empty because debian/nodejs/build deletes every .test.ts/.test.tsx file from packages//src before the test could run, and jest's config only has roots under packages/ (the file list says scripts/).
Fix: Drop || true, stop deleting the test sources in debian/nodejs/build, and run jest with its own config so the test fails on a broken build.

Verified ◂

The pre-review scan found no listed files and no holder missing by its check; I confirmed its author list against debian/copyright and found the two unattributed origins reported above.
debian/copyright is DEP-5 (correct Format URL); every stanza, the standalone Expat and ISC paragraphs, and Files-Excluded were read; .yarn and website are indeed absent from the tree, so Files-Excluded matches the repack.
Whole-tree grep (736 files, .pc/ and debian/ excluded) for Copyright/(C)/©/SPDX/Licensed under/Permission is hereby granted/GNU/Apache/MPL/public domain/non-commercial found only the top-level LICENSE, examples/rspack/LICENSE and README licence statements; every licence is MIT/Expat, so no DFSG-restricted terms and no licence incompatibility in the single binary package.
package.json author fields match the stanzas for packages/detect-locale and packages/remote-loader (Sergio Moreno), packages/metro-transformer (Vojtech Novak) and packages/extractor-vue (Christoffer Jahren); examples/rspack/LICENSE (2023 Collin Brown) matches its stanza.
packages/babel-plugin-lingui-macro/src/utils/cleanJSXElementLiteralChild.ts is babel code taken from the babel repo, as its header says, and has its own Expat stanza naming Sebastian McKenzie — correctly handled.
examples/js/src/locale/{cs,en}/messages.js are compiled catalogs, but their generator inputs messages.po are shipped next to them, so this is not a missing-source problem.
Binary assets recorded by name only, not opened: examples//public/.svg and favicon.ico, examples/react-native/assets/{adaptive-icon,favicon,icon,splash}.png, examples/create-react-app/src/logo.svg — template assets of the examples, which are not installed by pkg-js-tools (its directory filter drops examples).
CODE_OF_CONDUCT.md is an adapted Contributor Covenant 2.0, credited in its own Attribution section; not treated as a separate inaccuracy.
debian/lrc.config and the unused standalone License: ISC paragraph refer to .yarn/releases/yarn-3.4.1.cjs, which the repack excludes; harmless leftovers, nothing left in the tree to license-check.
All files under debian/ were read (control, rules, changelog, copyright, gbp.conf, salsa-ci.yml, lrc.config, source/format, upstream/metadata, the five debian/nodejs helper files and debian/tests/pkg-js/*); there is no debian/patches directory, so quilt patches are not a concern.
Inventory covered packages/* (19 packages), examples/* (10 examples), scripts/, test/, .github/, .husky/ and the top-level files; yarn.lock files are lockfile data, not code, and were not licence-grepped.
uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 6.12.0, packaged 5.4.1+ds), which is not a fault of the package.

Not confirmed ◂

packages/cli/src/api/pseudoLocalize.ts says its HTML-tag regex was taken from https://haacked.com/archive/2004/10/25/usingregularegexpressionstomatchhtml.aspx; the package states no licence for that fragment, and whether it is protected and needs attribution is a judgement call.
I could not build or import the package, so the consequence of the tsc build (dist/.js instead of dist/.cjs|*.mjs) is reasoned from debian/nodejs/build and the manifests, not observed.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader rejected this upload in response to the review.

Review Information

rejected — allocated to dfsg-uploader 1 day ago, started 1 day ago, completed 1 day ago.

Final Comment

The uploader rejected this upload in response to the automated (LLM) review of it, so that they can fix the problems it found and upload again.

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
5.4.1-1	25d54707…	2026-11-06 11:11	2026-11-06 11:11	dfsg-uploader	rejected	VIEW

Back to Dashboard | View all reviews for this package