DFSG NEW review for node-lit-ntml version 4.0.2-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 1 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

The package is a single-author TypeScript library under the MIT/Expat licence. debian/copyright is in DEP-5 machine-readable format and accurately names the sole upstream holder (Rong Sen Ng, 2023) and the Debian packaging holder (Edward Betts, 2026), with the full Expat text included. No vendored node_modules, no pre-built/minified artefacts, and no non-free terms were found; the one deviation is the Contributor Covenant code-of-conduct, noted as a minor issue below.

Packaging

Packaging is clean and follows current nodejs-team practice: dh with debhelper-compat 14 and the pkg-js-tools sequences, a correct single all-arch binary package, a minimal debian/rules, an autopkgtest-pkg-nodejs suite that compiles the TS tests and runs them with node:test, correct <!nocheck> marking of node-types-node, and a sensible dgit-style combined patch adapting the tests from vitest to node:test. Standards-Version 4.7.4, Vcs-* and upstream/metadata are all present and correct.

Issues

1. [minor] [licensing] code-of-conduct.md is adapted from the Contributor Covenant (CC-BY-4.0), but Files: * assigns it Expat

• Files: code-of-conduct.md:87-92, debian/copyright:5-8
• Basis: checked, in the package or with a reference tool
• Evidence: This Code of Conduct is adapted from the Contributor Covenant, version 1.4, available at http://contributor-covenant.org/version/1/4; debian/copyright has Files: * ... License: Expat.
• Problem: The Contributor Covenant is published under the Creative Commons Attribution 4.0 International licence, so this file is CC-BY-4.0 rather than Expat, and debian/copyright does not record that. CC-BY-4.0 is DFSG-free and the required attribution is present, so this is only a minor inaccuracy, not a DFSG problem.
• Fix: Add a Files: code-of-conduct.md stanza with License: CC-BY-4.0 (and a short stand-alone licence reference), or replace the file's adapted text.

Verified

• debian/copyright read in full: DEP-5 format, Files: * (Copyright 2023 Rong Sen Ng, License Expat) and Files: debian/* (Copyright 2026 Edward Betts, License Expat), with the full Expat text in a stand-alone stanza.
• LICENSE matches the Expat text and holder Copyright © 2023 Rong Sen Ng <wes.ngrongsen@gmail.com>; package.json author and license: MIT agree.
• A grep for copyright/licence wording across the tree found only Rong Sen Ng and the LICENSE/README references; the prescan author check also reports every holder found is named in debian/copyright, so no file needs its own stanza for a missing holder.
• No vendored third-party code: node_modules/ is gitignored and absent from the tarball; package.json declares only parse5 and tslib as dependencies, resolved via node-parse5 at build/runtime rather than embedded.
• Source is complete TypeScript under src/ (index, parse-literals, parse-literals-sync, process-literals, process-literals-sync, plus tests and benchmarks); no .js/.map/minified/binary build artefacts are shipped (dist/ is built at package time and removed by debian/clean).
• packaging files read in full: control, rules, changelog, source/format, clean, nodejs/build (tsc -p tsconfig.json), nodejs/extlinks, patches/series and the dgit-changes patch, tests/pkg-js/*, upstream/metadata; debian/watch not reviewed (checked separately).
• uscan found the packaged version as the newest upstream release (upstream 4.0.2, packaged 4.0.2).

Not confirmed

• No manual page for dh_nodejs is installed on the reviewing system, so the exact extlinks syntax (parse5 / @types/node test) was judged against standard pkg-js-tools practice rather than its documentation.

Proposed changes

None.