• Read debian/ in full (control, rules, changelog, copyright, clean, gbp.conf, salsa-ci.yml, source/format, patches/series and both patches, tests/, upstream/metadata, the debian/nodejs/ tree, build_modules/, generate-vue-icons.mjs, babel.config.json). debian/watch was left alone as instructed.
• Licence inventory: the tree holds exactly six licence-bearing files - LICENSE, svgson/LICENSE and the four debian/build_modules/*/LICENSE. Grep of the whole tree for Copyright/(c)/©/SPDX/Licensed under/permission clauses/GNU/Apache/MPL/CC/public domain found no other licence or holder.
• LICENSE is ISC (Copyright (c) 2026 Lucide Icons and Contributors) plus an Expat/MIT section for the Feather-derived icons (Copyright (c) 2013-present Cole Bemis); debian/copyright reproduces both texts and names both holders. The scan's near-match 'Lucide Icons and Contributors' is in the file as 'Lucide Icons and Contributor' (singular) and Cole Bemis is listed as 2013-2016, i.e. year drift only.
• svgson/ (its own orig tarball, gbp component) is MIT, Copyright (c) 2018 Lionel Tzatzkin; Files: svgson/* gives Expat with the same holder, and the Expat text is in the file.
• debian/build_modules/{rename-keys,deep-rename-keys,xml-reader,xml-lexer}: MIT, © Jon Schlinkert (2014-2017 / 2015-2017) and © 2016 Pedro Ladaria, matching the two stanzas. None of the four is packaged in Debian (apt-cache finds no node-rename-keys, node-deep-rename-keys, node-xml-reader, node-xml-lexer), so vendoring them in debian/build_modules is right rather than an embedded library.
• All packages/*/package.json declare "license": "ISC"; every shipped module is therefore under the documented licence.
• Icons: the icons/ tree (thousands of SVG/JSON pairs) carries no per-file notices; upstream removed the brand icons in v1 (docs/guide/version-1.md:50), and the two brand-adjacent names left, icons/apple.* and icons/bitcoin.*, are generic stroke glyphs, not the companies' marks.
• Binary assets in docs (favicons, mstile/apple-touch PNGs, 12 documentation screenshots under docs/images/, the two OG PNGs, framework-logos/lustre.webp) are upstream documentation assets of its own making, except the third-party logos reported above; og.png is produced by the present docs/.vitepress/createOGImage.ts.
• docs/public/templates/illustrator_template.ai (the scan's PDF) is an Adobe Illustrator template, which is its editable source form, not a built file: docs/contribute/icons/illustrator-guide.md:15 links it for download. docs/public/templates/affinity_designer.aftemplate (the scan's unrecognised binary) is the same for Affinity Designer, linked from docs/contribute/icons/affinity-designer-guide.md:13. Neither is generated by the Debian build.
• packages/angular/.angular/cache/21.2.19/ng-packagr/10874da3... (35.6 MB, the text file longer than 4 MiB the scan could only partly read) and tsbuildinfo/lucide-angular.tsbuildinfo are Angular/ng-packagr build caches generated from packages/angular/src, which is present; the Debian build neither uses nor installs packages/angular, so no source is missing and nothing is shipped from them.
• packages/lucide-react-native/lucide-react-native.d.ts is a checked-in bundled declaration file whose TypeScript sources are in packages/lucide-react-native/src; no dist/, node_modules/ or minified bundle exists anywhere in the tree.
• Every Build-Depends entry I queried resolves in the archive: esbuild (Provides node-esbuild), node-tsx (Provides node-tsx), node-babel7, node-vue, node-rollup-plugin-babel/-commonjs/-node-resolve/-replace/-license/-dts, node-minimist, node-eventemitter3, node-isobject, node-svgtofont, node-typescript, rollup, dh-sequence-nodejs (Provides it); @types/node in debian/nodejs/extlinks is the virtual node-types-node provided by nodejs.
• Patches carry DEP-3 headers (Description, Author/From, Forwarded) and address things Debian lacks (rollup-plugin-esbuild, rollup-plugin-summary, rollup-plugin-visualizer, prettier in the icon generator, @vercel/blob, oslllo-svg-fixer types); rollup-plugins-esbuild.patch explains its esbuild transform plugin.
• Standards-Version 4.7.4 against Policy 4.7.4.1: same first two components, no issue. debhelper compat 13 with dh $@ and dh-sequence-nodejs; ${misc:Depends} present; no maintainer scripts needed; source format 3.0 (quilt).
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 1.69.0, packaged 1.55.0), which is not a fault of the package.

• docs/public/templates/illustrator_template.ai is a binary PDF/Illustrator file; I did not open it, so any embedded fonts or placed third-party artwork inside it are unchecked. Upstream's own document, so only that embedding matters.
• packages/vue/rollup.config.mjs passes includeExternal: ['@lucide/shared/types'] to rollup-plugin-dts, and @lucide/shared is not installed by node-lucide (debian/nodejs/submodules lists packages/vue only). If the produced dist/lucide-vue.d.ts imports that path, TypeScript consumers of @lucide/vue get an unresolved import; only a build can show whether the plugin inlines it.
• debian/watch looks at github.com/elrumordelaluz/svgson, but the Source field of debian/copyright names github.com/lucide-icons/lucide. Whether these are the same upstream was not checked.
• debian/watch looks at github.com/elrumordelaluz/svgson, but Repository in debian/upstream/metadata names github.com/lucide-icons/lucide. Whether these are the same upstream was not checked.

None.