Review: node-lucide 1.70.0+dfsg-1

Package Information

Description	Flexible icon set with open source icons (Node.js library) Lucide is a community-based fork of Feather Icons, providing a large collection of simple and clean vector icons as reusable components and modules for JavaScript applications.
Maintainer	Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed By	Jérémy Lal <kapouer@melix.org>
Sponsor	kapouer@melix.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/js-team/node-lucide.git (browse)
Closes	#1150297
Blocked Bugs	#1093255 (wishlist)
Tracker	https://tracker.debian.org/pkg/node-lucide
Uploaded	1 day ago

New Package Report

.changes◂

Version	1.70.0+dfsg-1
Changed-By	Jérémy Lal <kapouer@melix.org>
Architecture	source all
Distribution	unstable
Date	Fri, 06 Nov 2026 00:47:33 +0100
Source	node-lucide

Changelog◂

node-lucide (1.70.0+dfsg-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1150297)
     In collaboration with Andrew Lee (李健秋).

.dsc◂

Section	javascript
Priority	optional
Component	main
Package-List	node-lucide deb javascript optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: lucide
Upstream-Contact: https://github.com/lucide-icons/lucide/issues
Source: https://github.com/lucide-icons/lucide
Files-Excluded: docs/public

Files: *
Copyright: 2026 Lucide Icons and Contributor
License: ISC

Files: icons/airplay.*
 icons/aperture.*
 icons/arrow-down.*
 icons/arrow-down-left.*
 icons/arrow-down-right.*
 icons/arrow-left.*
 icons/arrow-right.*
 icons/arrow-up.*
 icons/arrow-up-left.*
 icons/arrow-up-right.*
 icons/at-sign.*
 icons/calendar.*
 icons/cast.*
 icons/check.*
 icons/chevron-down.*
 icons/chevron-left.*
 icons/chevron-right.*
 icons/chevron-up.*
 icons/chevrons-down.*
 icons/chevrons-left.*
 icons/chevrons-right.*
 icons/chevrons-up.*
 icons/circle.*
 icons/circle-arrow-down.*
 icons/circle-arrow-left.*
 icons/circle-arrow-right.*
 icons/circle-arrow-up.*
 icons/circle-divide.*
 icons/circle-exclamation-point.*
 icons/circle-minus.*
 icons/circle-pause.*
 icons/circle-plus.*
 icons/circle-question-mark.*
 icons/circle-x.*
 icons/clipboard.*
 icons/clock.*
 icons/code.*
 icons/columns-2.*
 icons/command.*
 icons/compass.*
 icons/corner-down-left.*
 icons/corner-down-right.*
 icons/corner-left-down.*
 icons/corner-left-up.*
 icons/corner-right-down.*
 icons/corner-right-up.*
 icons/corner-up-left.*
 icons/corner-up-right.*
 icons/crosshair.*
 icons/database.*
 icons/dollar-sign.*
 icons/download.*
 icons/eighth-notes.*
 icons/ellipsis.*
 icons/ellipsis-vertical.*
 icons/external-link.*
 icons/face-neutral.*
 icons/face-slightly-frowning.*
 icons/face-slightly-smiling.*
 icons/feather.*
 icons/hash.*
 icons/headphones.*
 icons/info.*
 icons/italic.*
 icons/key.*
 icons/life-buoy.*
 icons/link.*
 icons/link-2.*
 icons/loader.*
 icons/lock.*
 icons/log-in.*
 icons/log-out.*
 icons/maximize.*
 icons/minimize.*
 icons/minimize-2.*
 icons/minus.*
 icons/monitor.*
 icons/moon.*
 icons/move.*
 icons/navigation.*
 icons/navigation-2.*
 icons/octagon.*
 icons/octagon-exclamation-point.*
 icons/octagon-x.*
 icons/panel-left.*
 icons/panels-top-left.*
 icons/percent.*
 icons/plus.*
 icons/power.*
 icons/radio.*
 icons/rss.*
 icons/search.*
 icons/server.*
 icons/share.*
 icons/shopping-bag.*
 icons/smartphone.*
 icons/square.*
 icons/square-divide.*
 icons/square-minus.*
 icons/square-plus.*
 icons/square-x.*
 icons/table-2.*
 icons/tablet.*
 icons/target.*
 icons/terminal.*
 icons/trash.*
 icons/triangle.*
 icons/triangle-exclamation-point.*
 icons/tv.*
 icons/type.*
 icons/upload.*
 icons/x.*
 icons/zoom-in.*
 icons/zoom-out.*
Copyright: 2013-2016 Cole Bemis
License: Expat
Comment: derived from the Feather project. Names do not match with what is listed in LICENSE.
 See https://github.com/lucide-icons/lucide/issues/119.

Files: CODE_OF_CONDUCT.md
Copyright: Unknown
Comment: This Code of Conduct is adapted from the Contributor Covenant, version 3.0, permanently available at https://www.contributor-covenant.org/version/3/0/
License: CC-BY-SA-4.0
 This work is licensed under the Creative Commons Attribution-ShareAlike 4.0
 International License.
 .
 On Debian systems, the complete text of the Creative Commons
 Attribution-ShareAlike 4.0 International License can be found in
 "/usr/share/common-licenses/CC-BY-SA-4.0".

Files: debian/*
Copyright: 2026 Jérémy Lal <kapouer@melix.org>
License: Expat

Files: debian/build_modules/rename-keys/*
 debian/build_modules/deep-rename-keys/*
Copyright: 2014-2017, Jon Schlinkert
License: Expat

Files: debian/build_modules/xml-reader/*
 debian/build_modules/xml-lexer/*
Copyright: 2016 Pedro Ladaria
License: Expat

Files: svgson/*
Copyright: 2018 Lionel Tzatzkin
License: Expat

License: ISC
 Permission to use, copy, modify, and/or distribute this software for any
 purpose with or without fee is hereby granted, provided that the above
 copyright notice and this permission notice appear in all copies.
 .
 THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 1 important, 4 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 day ago.

Report◂

DFSG NEW review for node-lucide version 1.70.0+dfsg-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: No
Issues: 0 blocker, 1 important, 4 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

Every file is under a free licence and the licences are compatible: ISC for Lucide's own code, icons and docs, Expat (MIT) for the Feather-derived icons and for the vendored svgson and build-only modules, CC-BY-SA-4.0 for the code of conduct. debian/copyright is DEP-5, its Files: stanzas override in the right order, it includes the full ISC and Expat texts and a correct pointer to /usr/share/common-licenses/CC-BY-SA-4.0, and no holder named in the tree is missing (the prescan's "Lucide Icons and Contributors" is the Files: * holder, spelled "Contributor" there). Only cosmetic slips remain.

Packaging

The packaging is deliberate work — a component build order with debian/nodejs/*/build scripts, four DEP-3 patches, vendored build-only npm modules that Debian does not ship — and it will build and install. But it is not ready to upload as is: the orig tarball carries a 36 MB Angular build cache containing the upstream author's absolute paths, debian/clean does not remove the icon/alias sources the build generates (Policy 4.9), the autopkgtest it ships is inert, and two dead debian files and a stale version banner remain.

Issues

important packaging 1. The orig tarball ships a 35.6 MB Angular build cache with the upstream developer's absolute paths ◂

Files: packages/angular/.angular/cache/21.2.19/ng-packagr/10874da3fb3e1c9df348ed355bf2b0ca82dbe0c880cf69f052802c177281d5e7, packages/angular/.angular/cache/21.2.19/ng-packagr/tsbuildinfo/lucide-angular.tsbuildinfo, node-lucide_1.70.0+dfsg.orig.tar.xz, debian/copyright:6
Basis: checked, in the package or with a reference tool
Evidence: The cache file is a single 35.6 MB JSON line holding e.g. "facadeModuleId":"/Users/eric.fennis/Development/lucide/packages/angular/dist/tmp-typings/lucide-angular.d.ts"; it is present in the orig tarball (lucide-icons-lucide-b826f0c/packages/angular/.angular/), and debian/copyright excludes only docs/public.
Problem: A committed .angular/ng-packagr cache is build output: it is machine-specific, leaks the upstream developer's home directory into the source package, and makes the source package 35 MB bigger than the code it contains. It is not generated from anything the Debian build needs, and packages/angular is not even built here.
Fix: Repack with packages/angular/.angular in Files-Excluded (and in the watch exclusions so uscan does not fetch it back), or ask upstream to drop the committed cache and re-tag; also make sure debian/rules clean would remove it if a build ever created it.

minor packaging 2. debian/clean leaves the icon and alias sources generated by the build, contrary to Policy 4.9 ◂

Files: debian/clean, debian/nodejs/packages/lucide/build, debian/nodejs/packages/vue/build, tools/build-icons/building/generateIconFiles.ts, tools/build-icons/building/aliases/generateAliasesFiles.ts
Basis: checked, in the package or with a reference tool
Evidence: debian/clean lists only packages/vue/src/icons/*.ts (plus dist/, node_modules/, packages/*/dist/, packages/*/.tsbuildinfo, svgson/dist/), while the lucide build runs build-icons --output=./src which writes src/icons/*.ts and src/aliases/aliases.ts (path.join(outputDirectory, 'aliases')), and the vue build writes src/aliases/aliases.ts, prefixed.ts and suffixed.ts.
Problem: Policy 4.9 requires the clean target to undo the effects of build and binary; the generated sources under packages/lucide/src/{icons,aliases} and packages/vue/src/aliases survive debian/rules clean, so dpkg-source -b from a once-built tree aborts on unrepresentable changes, and a rebuild starts from stale generated files.
Fix: Add packages/lucide/src/icons/*.ts, packages/lucide/src/aliases/*.ts and packages/vue/src/aliases/*.ts to debian/clean (and the same for any other component that gets built).

minor packaging 3. The autopkgtest is inert: the pkg-js test script tests nothing and debian/control has no Testsuite field ◂

Files: debian/tests/pkg-js/test:5, debian/control
Basis: checked, in the package or with a reference tool
Evidence: debian/tests/pkg-js/test is #!/bin/sh / set -e / # Test local require from packages/vue directory / #node -e "require('@lucide/vue')" — the only command is commented out; the Source stanza of debian/control has no Testsuite: field and there is no debian/tests/control.
Problem: As shipped the test can never fail, and with no Testsuite: header (per the autopkgtest specification, which asks packages to declare Testsuite: autopkgtest-pkg-nodejs for this kind of implicit control file) the debian/tests/pkg-js tree is not even discovered, so the package has no autopkgtest coverage at all.
Fix: Declare Testsuite: autopkgtest-pkg-nodejs in debian/control and make debian/tests/pkg-js/test actually require the installed modules, e.g. node -e "require('lucide'); require('@lucide/vue'); require('svgson')".

minor packaging 4. debian/generate-vue-icons.mjs and debian/babel.config.json are leftovers of an abandoned build approach ◂

Files: debian/generate-vue-icons.mjs, debian/babel.config.json
Basis: checked, in the package or with a reference tool
Evidence: Nothing in debian/rules or debian/nodejs/ refers to either file (the only babel.config hits are upstream .npmignore lines); the header of debian/patches/rollup-plugins-esbuild.patch says "The previous @babel/core based workaround for packages/vue is therefore dropped", and the vue build now uses tsx ../../tools/build-icons/cli.ts.
Problem: Dead packaging files mislead the next maintainer into thinking the vue components are generated by the babel helper, and if they ever were used the babel presets they name would need Build-Depends.
Fix: Delete both files.

minor packaging 5. The shipped dist bundles carry the placeholder version 0.0.1 in their licence banner ◂

Files: debian/rules:19-20, packages/lucide/package.json:4, tools/rollup-plugins/plugins.js
Basis: inferred from what was read, not seen directly
Evidence: debian/rules only rewrites packages/{lucide,vue}/package.json in execute_before_dh_auto_install, while the bundles are built earlier by dh_auto_build; the rollup licence plugin bakes banner: \@license ${pkg.name} v${pkg.version} - ${pkg.license} ...`from the package.json read at build time, which still says"version": "0.0.1"`.
Problem: The files users install therefore advertise lucide v0.0.1 and @lucide/vue v0.0.1 in their headers while the installed package.json says 1.70.0+dfsg, which is confusing when reading bug reports and does not match the archive version.
Fix: Do the version rewrite in execute_before_dh_auto_build (and restore it in execute_after_dh_auto_install), or patch the placeholder versions in package.json with a quilt patch.

Verified ◂

Holder check: LICENSE:3 says Copyright (c) 2026 Lucide Icons and Contributors and debian/copyright:8 says Copyright: 2026 Lucide Icons and Contributor — the same holder with a dropped s, no different entity, so no holder is missing (cosmetic, not reported as an issue).
Feather-derived icons: the icons/... stanza paths all exist and correspond to the names in LICENSE:21 through the current icon names (icons/circle-exclamation-point.json has alias alert-circle, icons/panels-top-left.json has alias layout, icons/face-neutral/face-slightly-smiling/face-slightly-frowning are meh/smile/frown); Copyright: 2013-2016 Cole Bemis against LICENSE's 2013-present is year drift only, and the full Expat text is in the file.
CODE_OF_CONDUCT.md is an adaptation of Contributor Covenant 3.0, which is CC BY-SA 4.0 as debian/copyright:133 says; the file names Copyright: Unknown and no other holder is discoverable in it.
svgson/ comes from the separate orig-svgson.tar.xz component (watch Component: svgson, gbp.conf component); its LICENSE is MIT/Expat for Lionel Tzatzkin as the svgson/* stanza says. Its CODE_OF_CONDUCT.md carries no licence notice of its own — it is an adaptation of Contributor Covenant 1.4, whose CC BY terms permit relicensing under svgson's MIT — so the stanza's Expat is the only licence claimed for it.
debian/build_modules/{rename-keys,deep-rename-keys,xml-reader,xml-lexer} each ship an MIT LICENSE matching the stanzas; apt-cache shows Debian has no node-rename-keys, node-deep-rename-keys, node-xml-reader or node-xml-lexer, so they are not duplicate embedded copies, and debian/nodejs/extlinks keeps them build-time only.
Debian has no node-svgson either (apt-cache); the vendored svgson is installed into /usr/share/nodejs by debian/nodejs/submodules, which is the only way it is shipped and is justified while the archive lacks it.
No fonts, PDFs, archives, minified JS/CSS or source maps in the tree (glob for *.ttf, *.woff*, *.pdf, *.zip, *.min.js, *.map etc. found none). The PNGs under docs/images/docs/guide/images are documentation screenshots and docs/images/package-logos/ holds the project's own package logos — all under Files: */ISC.
The scan's "text file longer than 4 MiB" is the 35.6 MB Angular cache reported as an issue, plus its tsbuildinfo; both are ng-packagr output for packages/angular/src, whose sources are in the package, so they raise no licensing question.
docs/public/ is genuinely absent from the tree, so Files-Excluded: docs/public is honest and the company/sponsor logos it contained are not shipped.
licensing of debian/*: the single holder 2026 Jérémy Lal is the packaging author; the From:/Author: headers of the three patches credit Jérémy Lal and Andrew Lee, which is authorship metadata rather than a copyright notice, so I did not report it.
packaging basics: debian/rules is plain dh $@ at compat 13; ${misc:Depends} and ${nodejs:Provides} are present; Depends: node-vue is required by @lucide/vue's peerDependencies: vue >=3.0.1 and unstable's node-vue is 3.5.43; no maintainer scripts or maintscripts exist to be wrong.
debian/nodejs/extlinks names are resolvable: @types/node is provided by nodejs (virtual node-types-node), @types/minimist by node-minimist; the other build deps are ordinary archive packages.
debian/source/format is 3.0 (quilt) with the svgson component, consistent with gbp.conf, the watch Component: line and debian/nodejs/submodules; Standards-Version: 4.7.4 against Policy 4.7.4.1 is current enough, and the changelog distribution, version and date are sane.
debian/upstream/metadata covers Bug-Database, Bug-Submit, Changelog, Documentation, Repository and Screenshots.
uscan found the packaged version as the newest upstream release (upstream 1.70.0, packaged 1.70.0+dfsg).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (CC-BY-SA-4.0).

Not confirmed ◂

No build was run: the stale v0.0.1 banner is reasoned from debian/rules (version set before install only), the rollup licence banner and the placeholder package.json versions, and the dpkg-source -b abort from the leftover generated files is reasoned from the paths, not observed.
I could not check that Debian's esbuild binary package provides the esbuild Node module under /usr/share/nodejs that debian/nodejs/extlinks links (pkg-js-tools aborts on an unresolvable extlink). It is not installed on the reviewing system; the patch and extlinks assume it exists.
Autopkgtest discovery was checked against the autopkgtest specification's Testsuite: requirement and the files themselves, not by running debci.
debian/watch looks at github.com/elrumordelaluz/svgson, but the Source field of debian/copyright names github.com/lucide-icons/lucide. Whether these are the same upstream was not checked.
debian/watch looks at github.com/elrumordelaluz/svgson, but Repository in debian/upstream/metadata names github.com/lucide-icons/lucide. Whether these are the same upstream was not checked.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader rejected this upload in response to the review.

Review Information

rejected — allocated to dfsg-uploader 1 day ago, started 1 day ago, completed 1 day ago.

Final Comment

The uploader rejected this upload in response to the automated (LLM) review of it, so that they can fix the problems it found and upload again.

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
1.55.0-1	520a2c24…	2026-11-06 06:22	2026-11-06 06:22	dfsg-uploader	rejected	VIEW
1.52.0-1	5b7ba9b2…	2026-10-19 09:51	2026-10-19 09:51	dfsg-uploader	rejected	VIEW

Back to Dashboard | View all reviews for this package