node-lucide 1.70.0+dfsg-1

Package Information

Description	Flexible icon set with open source icons (Node.js library) Lucide is a community-based fork of Feather Icons, providing a large collection of simple and clean vector icons as reusable components and modules for JavaScript applications.
Maintainer	Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed By	Jérémy Lal <kapouer@melix.org>
Sponsor	kapouer@melix.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/js-team/node-lucide.git (browse)
Closes	#1150297
Blocked Bugs	#1093255 (wishlist)
Tracker	https://tracker.debian.org/pkg/node-lucide
Uploaded	7 hours ago

New Package Report

.changes◂

Architecture	source all
Distribution	unstable
Date	Fri, 06 Nov 2026 00:47:33 +0100
Source	node-lucide
Version	1.70.0+dfsg-1
Changed-By	Jérémy Lal <kapouer@melix.org>

Changelog◂

node-lucide (1.70.0+dfsg-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1150297)
     In collaboration with Andrew Lee (李健秋).

.dsc◂

Priority	optional
Component	main
Package-List	node-lucide deb javascript optional arch=all
Section	javascript

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: lucide
Upstream-Contact: https://github.com/lucide-icons/lucide/issues
Source: https://github.com/lucide-icons/lucide
Files-Excluded: docs/public
 packages/angular/.angular

Files: *
Copyright: 2026 Lucide Icons and Contributor
License: ISC

Files: icons/airplay.*
 icons/aperture.*
 icons/arrow-down.*
 icons/arrow-down-left.*
 icons/arrow-down-right.*
 icons/arrow-left.*
 icons/arrow-right.*
 icons/arrow-up.*
 icons/arrow-up-left.*
 icons/arrow-up-right.*
 icons/at-sign.*
 icons/calendar.*
 icons/cast.*
 icons/check.*
 icons/chevron-down.*
 icons/chevron-left.*
 icons/chevron-right.*
 icons/chevron-up.*
 icons/chevrons-down.*
 icons/chevrons-left.*
 icons/chevrons-right.*
 icons/chevrons-up.*
 icons/circle.*
 icons/circle-arrow-down.*
 icons/circle-arrow-left.*
 icons/circle-arrow-right.*
 icons/circle-arrow-up.*
 icons/circle-divide.*
 icons/circle-exclamation-point.*
 icons/circle-minus.*
 icons/circle-pause.*
 icons/circle-plus.*
 icons/circle-question-mark.*
 icons/circle-x.*
 icons/clipboard.*
 icons/clock.*
 icons/code.*
 icons/columns-2.*
 icons/command.*
 icons/compass.*
 icons/corner-down-left.*
 icons/corner-down-right.*
 icons/corner-left-down.*
 icons/corner-left-up.*
 icons/corner-right-down.*
 icons/corner-right-up.*
 icons/corner-up-left.*
 icons/corner-up-right.*
 icons/crosshair.*
 icons/database.*
 icons/dollar-sign.*
 icons/download.*
 icons/eighth-notes.*
 icons/ellipsis.*
 icons/ellipsis-vertical.*
 icons/external-link.*
 icons/face-neutral.*
 icons/face-slightly-frowning.*
 icons/face-slightly-smiling.*
 icons/feather.*
 icons/hash.*
 icons/headphones.*
 icons/info.*
 icons/italic.*
 icons/key.*
 icons/life-buoy.*
 icons/link.*
 icons/link-2.*
 icons/loader.*
 icons/lock.*
 icons/log-in.*
 icons/log-out.*
 icons/maximize.*
 icons/minimize.*
 icons/minimize-2.*
 icons/minus.*
 icons/monitor.*
 icons/moon.*
 icons/move.*
 icons/navigation.*
 icons/navigation-2.*
 icons/octagon.*
 icons/octagon-exclamation-point.*
 icons/octagon-x.*
 icons/panel-left.*
 icons/panels-top-left.*
 icons/percent.*
 icons/plus.*
 icons/power.*
 icons/radio.*
 icons/rss.*
 icons/search.*
 icons/server.*
 icons/share.*
 icons/shopping-bag.*
 icons/smartphone.*
 icons/square.*
 icons/square-divide.*
 icons/square-minus.*
 icons/square-plus.*
 icons/square-x.*
 icons/table-2.*
 icons/tablet.*
 icons/target.*
 icons/terminal.*
 icons/trash.*
 icons/triangle.*
 icons/triangle-exclamation-point.*
 icons/tv.*
 icons/type.*
 icons/upload.*
 icons/x.*
 icons/zoom-in.*
 icons/zoom-out.*
Copyright: 2013-2016 Cole Bemis
License: Expat
Comment: derived from the Feather project. Names do not match with what is listed in LICENSE.
 See https://github.com/lucide-icons/lucide/issues/119.

Files: CODE_OF_CONDUCT.md
Copyright: Unknown
Comment: This Code of Conduct is adapted from the Contributor Covenant, version 3.0, permanently available at https://www.contributor-covenant.org/version/3/0/
License: CC-BY-SA-4.0
 This work is licensed under the Creative Commons Attribution-ShareAlike 4.0
 International License.
 .
 On Debian systems, the complete text of the Creative Commons
 Attribution-ShareAlike 4.0 International License can be found in
 "/usr/share/common-licenses/CC-BY-SA-4.0".

Files: debian/*
Copyright: 2026 Jérémy Lal <kapouer@melix.org>
License: Expat

Files: debian/build_modules/rename-keys/*
 debian/build_modules/deep-rename-keys/*
Copyright: 2014-2017, Jon Schlinkert
License: Expat

Files: debian/build_modules/xml-reader/*
 debian/build_modules/xml-lexer/*
Copyright: 2016 Pedro Ladaria
License: Expat

Files: svgson/*
Copyright: 2018 Lionel Tzatzkin
License: Expat

License: ISC
 Permission to use, copy, modify, and/or distribute this software for any
 purpose with or without fee is hereby granted, provided that the above
 copyright notice and this permission notice appear in all copies.
 .
 THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 1 blocker, 0 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 5 hours ago.

Report◂

DFSG NEW review for node-lucide version 1.70.0+dfsg-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 1 blocker, 0 important, 2 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

Everything in the tree is under a DFSG-free licence: ISC for the Lucide code, icons and documentation, MIT/Expat for the Feather-derived icons (listed icon by icon in debian/copyright with their current renamed names), MIT for the svgson component and for the four modules vendored in debian/build_modules, and CC-BY-SA-4.0 for the top-level code of conduct (text in /usr/share/common-licenses). No non-free terms, no file without a licence, no built file without its source. debian/copyright is a valid DEP-5 file with correct placeholder-to-current-name mapping and complete ISC/Expat texts, but it is not accurate for every file: the MIT code ported into docs/.vitepress/theme/components/base/MotionCounter.vue is attributed to nobody, and the blanket Files: svgson/* stanza calls svgson/CODE_OF_CONDUCT.md MIT although it is a Contributor Covenant copy carrying no MIT notice.

Packaging

Competent pkg-js-tools packaging. dh-sequence-nodejs drives the multi-component build through debian/nodejs/{main,additional_components,build_order,component_links,submodules,root_modules,extlinks} and per-component build scripts; debian/build_modules is the documented place for the four modules Debian does not ship (none of rename-keys, deep-rename-keys, xml-reader, xml-lexer or svgson exists in the archive). Build-Depends covers every module the built components import, the three patches carry DEP-3 headers with rationale, Provides/Depends are generated/needed correctly, and the Standards-Version 4.7.4 is current against Policy 4.7.4.1. The one defect is the clean target: a find on the wrong path (and a build-created packages/vue/LICENSE that debian/clean does not list) leaves generated files behind after debian/rules clean.

Issues

blocker licensing 1. debian/copyright does not name Tanja Gomilar or the MIT licence of the ported docs/.vitepress/theme/components/base/MotionCounter.vue ◂

Files: docs/.vitepress/theme/components/base/MotionCounter.vue:6-8, debian/copyright (Files: * stanza)
Basis: checked, in the package or with a reference tool
Evidence: MotionCounter.vue:7: * Ported from motion-counter by Tanja Gomilar (MIT): https://github.com/tgomilar/motion-components. The only stanza matching the file is Files: * / Copyright: 2026 Lucide Icons and Contributor / License: ISC.
Problem: The file is a 71-line port of third-party MIT-licensed code, but its copyright holder and licence are nowhere in debian/copyright, which therefore misdescribes it as ISC Lucide code. The MIT condition that the copyright notice and permission text accompany copies is also unmet, since the port keeps only the URL.
Fix: Add a stanza, later than Files: *, for docs/.vitepress/theme/components/base/MotionCounter.vue with Copyright: Tanja Gomilar and License: Expat (the Expat text is already among the stand-alone License paragraphs).

minor licensing 2. Files: svgson/* calls svgson/CODE_OF_CONDUCT.md MIT, but it is a Contributor Covenant copy with no MIT notice ◂

Files: svgson/CODE_OF_CONDUCT.md:67-72, debian/copyright (Files: svgson/* stanza)
Basis: inferred from what was read, not seen directly
Evidence: This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html; the file contains no MIT text or grant. debian/copyright: Files: svgson/* / Copyright: 2018 Lionel Tzatzkin / License: Expat.
Problem: The Contributor Covenant text is licensed by its authors under a Creative Commons Attribution licence, not svgson's MIT, so the blanket svgson stanza misstates this file. The maintainers already gave the top-level CODE_OF_CONDUCT.md (covenant 3.0, CC-BY-SA-4.0) its own stanza, so this looks like an oversight rather than a deliberate choice.
Fix: Carve svgson/CODE_OF_CONDUCT.md out of the svgson stanza in a later Files paragraph with its own Copyright (Organization for Ethical Source / Contributor Covenant) and License: CC-BY-4.0, pointing to /usr/share/common-licenses/CC-BY-4.0.

minor packaging 3. debian/rules clean leaves packages/lucide/src/aliases/aliases.ts and packages/vue/LICENSE in the source tree ◂

Files: debian/rules (execute_before_dh_auto_clean), debian/clean, debian/nodejs/packages/vue/build
Basis: checked, in the package or with a reference tool
Evidence: find packages/lucide/src/aliases/index.ts -type f ! -name 'index.ts' -delete names one file, and excludes that very file name, so it can never delete anything; packages/lucide's build generates src/aliases/aliases.ts (tools/build-icons/building/aliases/generateAliasesFiles.ts writes aliases${fileExtension} into <output>/aliases). debian/nodejs/packages/vue/build does cp ../../LICENSE ./LICENSE, and no entry in debian/clean removes it.
Problem: debian/rules clean does not return the tree to its unpacked state: the lucide alias file survives (the vue one is removed by the correct find on the directory), and packages/vue/LICENSE is created during the build and never deleted, so a built tree stays dirty and those files get into a source package built from it.
Fix: Change the second find to find packages/lucide/src/aliases/ -type f ! -name 'index.ts' -delete, and add packages/vue/LICENSE (or packages/*/LICENSE) to debian/clean.

Verified ◂

Prescan files accounted for: LICENSE:3 and docs/.vitepress/getStructuredData.ts:7 both carry Copyright (c) 2026 Lucide Icons and Contributors, the same holder as the Files: * stanza (written there in the singular); getStructuredData.ts only builds strings and JSON-LD, no separate work orholder.
debian/copyright is DEP-5 with the correct Format URL, Files: *, one stanza per group, later stanzas overriding earlier ones, and complete ISC and Expat texts; CC-BY-SA-4.0 is in /usr/share/common-licenses (checked).
Licence sweep of the whole tree (excluding .pc/ and debian/) for Copyright, ©, SPDX-License-Identifier, licensed under, GNU/GPL/LGPL, Apache, MPL, BSD, Creative Commons, public domain, all rights reserved: the only licence texts are LICENSE, svgson/LICENSE, the four debian/build_modules/*/LICENSE files and the two Contributor Covenant attributions; no SPDX headers, no non-free wording.
Feather-derived icons: the name list in LICENSE (old names) was matched against the Files: icons/... stanza, which uses the current names (circle-exclamation-point, octagon-x, square-divide, face-slightly-smiling, eighth-notes, ellipsis, panel-left, panels-top-left, columns-2, ...); every old name has a renamed entry, and the old names no longer exist in icons/ (checked by glob). The stanza's Comment explains the renaming.
svgson/ is a separate upstream unpacked as orig-svgson; its LICENSE is MIT (2018 Lionel Tzatzkin) and matches the Files: svgson/* stanza; no other holder appears in it.
debian/build_modules/{rename-keys,deep-rename-keys,xml-reader,xml-lexer} are MIT sources with LICENSE files and "license": "MIT" in package.json, matching their stanzas; pkg-js-tools' link_build_modules() uses exactly debian/build_modules (/usr/share/perl5/Debian/PkgJs/Utils.pm:274).
None of the four vendored modules nor svgson is in the archive (apt-cache: node-rename-keys, node-deep-rename-keys, node-xml-reader, node-xml-lexer, node-svgson all absent), so vendoring them is justified rather than duplicating a Debian package.
Files-Excluded names docs/public and packages/angular/.angular; both are absent from the unpacked tree, so the +dfsg repack matches debian/copyright.
Binary assets: the only non-text files in the tree are 13 PNG screenshots under docs/guide/images/ and docs/images/ (Figma/Illustrator/VS Code dialogs illustrating the icon guide); no fonts, sounds, PDFs, archives, minified code or compiled output (extensions globbed); none opened, identified by path and location only.
packages/lucide-react-native/lucide-react-native.d.ts is a large generated declaration file but is upstream-committed and its source (src/, scripts/getIconEntryNamesAndAliases.mts, the rollup config) is in the package.
Build-Depends checked with apt-cache: esbuild (provides node-esbuild), node-tsx (virtual, provided by tsx), node-svgtofont, node-rollup-plugin-license, node-rollup-plugin-dts, node-rollup-plugin-babel, node-rollup-plugin-commonjs, node-eventemitter3, node-minimist and rollup all exist; @types/node is provided by nodejs (node-types-node virtual).
tools/*/build scripts run tsc with noEmit, and tools/build-font/src/outlineSVGs.ts's missing oslllo-svg-fixer is satisfied by the local ambient declaration tools/build-font/oslllo-svg-fixer.d.ts, so no build dependency is missing for it.
Standards-Version 4.7.4 against Policy 4.7.4.1 (policy tool): current. Maintainer scripts, debian/*.maintscript and debian/tests do not exist, so there is nothing there to be wrong.
The three patches in debian/patches/series have DEP-3 Description/Author/Last-Update/Forwarded fields, are applied in the tree (.pc/ present), explain why they are Debian-specific (missing rollup plugins, esbuild, vendored svgson deps, Vercel blob, rollup sanitizeFileName with a +dfsg directory) and none is obsolete.
uscan found the packaged version as the newest upstream release (upstream 1.70.0, packaged 1.70.0+dfsg).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (CC-BY-SA-4.0).

Not confirmed ◂

The docs/.vitepress/theme/components/overrides/ components (VPFooter.vue, VPCarbonAds.vue, VPNavBarSearch.vue, VPIconAlignLeft.vue, Hero.vue) carry no copyright headers and reuse VitePress class names and imports; whether they copy code from VitePress's MIT default theme could not be checked without VitePress sources.
Whether rollup-plugin-dts's includeExternal: ['@lucide/shared/types'] in packages/vue/rollup.config.mjs inlines that module into dist/lucide-vue.d.ts or leaves an import of it: if it leaves it, the installed @lucide/vue typings would reference @lucide/shared, which debian/nodejs/submodules does not install. Only a built package would show which.
The 13 docs PNG screenshots were not opened (binary); screenshots of Figma/Illustrator dialogs are assumed to be Lucide-created documentation images under the Files: * ISC stanza.
debian/watch looks at github.com/elrumordelaluz/svgson, but the Source field of debian/copyright names github.com/lucide-icons/lucide. Whether these are the same upstream was not checked.
debian/watch looks at github.com/elrumordelaluz/svgson, but Repository in debian/upstream/metadata names github.com/lucide-icons/lucide. Whether these are the same upstream was not checked.

Proposed changes ◂

None.

Uploader's response to the LLM review

Waiting for the uploader's response until 2026-11-08 21:27 UTC, because the review found serious issues.

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
1.70.0+dfsg-1	fb4d5de9…	2026-11-06 11:55	2026-11-06 11:55	dfsg-uploader	rejected	VIEW
1.55.0-1	520a2c24…	2026-11-06 06:22	2026-11-06 06:22	dfsg-uploader	rejected	VIEW
1.52.0-1	5b7ba9b2…	2026-10-19 09:51	2026-10-19 09:51	dfsg-uploader	rejected	VIEW

Back to Dashboard | View all reviews for this package