DFSG NEW review for node-postcss-inline-svg version 6.0.0-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 0 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

All of the source is MIT: the upstream LICENSE file and the README both state MIT with copyright 2015 Bogdan Chadkin, and no other holder or licence appears anywhere in the tree (the .github workflow, .husky hook, lib/, test/ and test/fixtures/ carry no notices at all). debian/copyright is DEP-5, its Files: * stanza matches the upstream MIT text and holder, debian/* is covered by its own later stanza, and the full MIT text is included as a stand-alone paragraph since MIT is not in /usr/share/common-licenses. No non-free terms, vendored third-party code, generated-but-sourceless files or unclear-provenance media were found.

Packaging

A small, conventionally packaged node module: debhelper compat 14 with a bare dh $@, dh-sequence-nodejs-no-lerna for the pkg-js-tools build and single-binary for the one binary package, both of which exist in the archive. Runtime Depends match package.json (css-select, dom-serializer, htmlparser2, postcss-value-parser, plus the postcss peer), Build-Depends adds jest <!nocheck> and the peer for the build-time test run, all of these are real packages. Standards-Version 4.7.4 is current, Vcs-* and Homepage are right, the ITP is closed in the changelog, and Testsuite: autopkgtest-pkg-nodejs plus debian/tests/pkg-js/test (jest) give autopkgtests. The single quilt patch is the dgit-generated combined delta, used to follow htmlparser2's parseDOM -> parseDocument API change.

Issues

None.

Verified

• LICENSE (prescan hit): the MIT licence text, Copyright 2015 Bogdan Chadkin <trysound@yandex.ru>, reproduced verbatim as the stand-alone License: MIT paragraph in debian/copyright.
• README.md (prescan hit): ends with MIT © [Bogdan Chadkin](mailto:trysound@yandex.ru), consistent with the Files: * stanza.
• yarn.lock (prescan hit): the grep matches are base64 integrity hashes that happen to contain letter runs like SPDX; the lockfile carries no copyright or licence statement and needs none.
• Prescan author check found no unlisted holder; the only holder in the tree is Bogdan Chadkin, named in Files: *. debian/* is the only other stanza (2026 Edward Betts, MIT), so no file is left uncovered.
• Read in full: debian/copyright, control, rules, changelog, patches/series, patches/dgit-changes, source/format, docs, tests/pkg-js/test, upstream/metadata, and /review/node-postcss-inline-svg_6.0.0-1.dsc.
• Grep for Copyright/(C)/©/SPDX/Licensed under/Permission is hereby granted/GNU/Apache/Mozilla/public domain/All rights reserved over the whole tree with gitignore off: hits only in LICENSE, README.md, yarn.lock and debian/copyright. No LICENSE/COPYING/NOTICE/AUTHORS file exists outside the top-level LICENSE.
• The .github/workflows/nodejs.yml and .husky/pre-commit are upstream CI/hook files with no notices; they are not installed (package.json files: ["lib"]), and are covered by Files: *. lib/.js, test/.js and test/fixtures/*.svg carry no notices of their own; upstream MIT covers them.
• The 9 test/fixtures/*.svg files are small upstream test data with no embedded text or notices; MIT by Files: *.
• Build-Depends and Depends names all resolve in the archive: jest 29.6.2, node-css-select 5.2.2, node-dom-serializer 3.1.1, node-htmlparser2 12.0.0, node-postcss 8.5.31, node-postcss-value-parser 4.2.0; dh-sequence-single-binary is provided by debhelper 14.5 and dh-sequence-nodejs-no-lerna by dh-nodejs 0.17.14.
• lib/ requires only htmlparser2, dom-serializer, css-select and postcss-value-parser; every one of them is in the package's Depends, and node-postcss is the declared peer (package.json peerDependencies ^8.1.4, archive has 8.5.31).
• debian/patches/series holds one patch, dgit-changes; the dgit-maint-merge header is dgit's own boilerplate, and the only delta is lib/render.js using parseDocument(...).children instead of the removed parseDOM, which the tree's lib/render.js reflects. The .dsc carries a matching Dgit: field.
• debian/rules is dh $@ only; the nodejs_no_lerna sequence supplies --buildsystem=nodejs_no_lerna to dh_auto_* and single-binary supplies --destdir=debian/tmp for the single binary package, so no override is needed and none is missing.
• No maintscripts, no debian/install or links files, no debian/tests/control needed (Testsuite: autopkgtest-pkg-nodejs synthesises it). Changelog is 6.0.0-1 to unstable, dated Thursday 29 October 2026, closing ITP #1152415. Standards-Version 4.7.4 matches the current Policy series.
• uscan found the packaged version as the newest upstream release (upstream 6.0.0, packaged 6.0.0).

Not confirmed

• package.json still requires htmlparser2 ^8.0.1 and dom-serializer ^2.0.0 while the archive has 12.0.0 and 3.1.1; the Debian patch adapts the code to the newer htmlparser2 API, but whether Debian's node-dom-serializer 3.1.1 still exposes the .default export that lib/render.js uses could not be checked on the reviewing system (the modules are not installed). Assumed to work because the maintainer's build runs the jest suite; a build would show it.

Proposed changes

None.