DFSG NEW Queue

DFSG, Licensing & New Packages Team

node-radix-ui 1.6.7+~3.0.0-1

Package Information

DescriptionUI component library for building high-quality accessible design

Radix Primitives is a low-level UI component library focused on accessibility, customization and developer experience. You can use these components either as the base of your design system, or adopt them incrementally.

This package provids the complete collection of Radix UI React components and primitives for Node.js environments.

MaintainerDebian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed ByAndrew Lee (李健秋) <ajqlee@debian.org>
Sponsorajqlee@debian.org
Distributionunstable
Architectureall
VCSgit: https://salsa.debian.org/js-team/node-primitives.git (browse)
Closes#1151391
Blocked Bugs#1093255 (wishlist)
Trackerhttps://tracker.debian.org/pkg/node-radix-ui
Uploaded1 hour ago

New Package Report

.changes◂
Changed-ByAndrew Lee (李健秋) <ajqlee@debian.org>
Architecturesource all
Distributionunstable
DateMon, 19 Oct 2026 12:46:11 +0200
Sourcenode-radix-ui
Version1.6.7+~3.0.0-1
Changelog◂ 
node-radix-ui (1.6.7+~3.0.0-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1151391)
.dsc◂
Sectionjavascript
Priorityoptional
Componentmain
Package-Listnode-radix-ui deb javascript optional arch=all
debian/copyright◂ 
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: Radix Primitives
Comment: name is node-radix-ui to match it's name on npmjs.org.

Files: *
Copyright: 2022-present WorkOS
License: Expat

Files: colors/*
Copyright: 2021 Radix
                Colm Tuite
                Vlad Moroz
License: Expat

Files: debian/*
Copyright: Andrew Lee (李健秋) <ajqlee@debian.org>
License: Expat

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 1 blocker, 1 important, 3 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 0 hours ago.

Report◂

DFSG NEW review for node-radix-ui version 1.6.7+~3.0.0-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: No
  • Packaging is of good quality: No
  • Issues: 1 blocker, 1 important, 3 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable
  • Scan before the review: nothing found

Licensing

All the code is under the Expat/MIT licence, which is DFSG-free, and the two licence files (top-level LICENSE for the primitives tree, colors/LICENSE for the separately unpacked colors component) are correctly grouped by debian/copyright. debian/copyright is nevertheless inaccurate: three files matched only by the Files: * stanza (which credits WorkOS alone) carry their own MIT notices naming AriaKit, React Training and Diego Haz, and none of those holders appears in the file. That is a copyright inaccuracy a sponsor will require fixed before upload.

Packaging

The packaging is structurally sound (compat 14, dh-sequence-nodejs, a working quilt patch, autopkgtest, sane version scheme), but the resulting binary cannot work: @radix-ui/react-popper and the radix-ui umbrella require @floating-ui/react-dom at run time, no Depends names it, and no Debian package provides it. The tsup-removal patch also silently drops the TypeScript declarations the upstream packages publish, while the installed package.json exports still point at them. The remaining items (unused build/runtime dependencies, a Provides for the root module debian/rules deletes) are minor.

Issues

blocker licensing 1. debian/copyright credits only WorkOS for files whose MIT notices name AriaKit, React Training and Diego Haz ◂
  • Files: debian/copyright:5-7, .changeset/changelog.cjs:1-2, packages/core/primitive/src/primitive.tsx:42-43, packages/core/rect/src/observe-element-rect.ts:1-2
  • Basis: checked, in the package or with a reference tool
  • Evidence: debian/copyright Files: * / Copyright: 2022-present WorkOS; .changeset/changelog.cjs:2 // MIT License, Copyright (c) Diego Haz; primitive.tsx:42-43 Lifted from https://github.com/ariakit/ariakit/... MIT License, Copyright (c) AriaKit.; observe-element-rect.ts:1-2 // Adapted from https://github.com/reach/observe-rect/tree / // MIT license, React Training.
  • Problem: These files are matched only by the catch-all stanza, which states that WorkOS alone holds the copyright. The Expat text the files carry requires the notice to be preserved and reproduced, so the copyright file must name these holders too (Policy 12.5); as written it misdescribes them. The isPointInPolygon ports in packages/react/menu/src/menu.tsx:1314 and packages/react/tooltip/src/tooltip.tsx:677, credited to https://github.com/substack/point-in-polygon, are a fourth, smaller instance: the loop is taken from that module and no copyright notice is kept there.
  • Fix: Add the missing holders (AriaKit, React Training, Diego Haz, and, if kept, the point-in-polygon author, with their years), either by splitting the three files into their own stanzas or by extending the Files: * Copyright list; consider preserving a copyright line in the menu/tooltip files upstream.
important packaging 2. Installed modules require @floating-ui/react-dom, which no Depends names and no Debian package provides ◂
  • Files: debian/control:27-31, packages/react/popper/package.json:38, packages/react/popper/src/popper.tsx:2-13, packages/react/radix-ui/src/index.ts:22,32,33, internal/builder/builder.js:77-82
  • Basis: checked, in the package or with a reference tool
  • Evidence: popper.tsx imports useFloating, autoUpdate, offset, shift, limitShift, hide, arrow as floatingUIarrow, flip, size from '@floating-ui/react-dom'; popper/package.json:38 "@floating-ui/react-dom": "^2.0.0"; builder.js sets packages: 'external', so the built dist keeps require("@floating-ui/react-dom"); debian/control Depends is only ${nodejs:Depends}, node-react, node-react-dom, node-react-test-renderer, node-react-remove-scroll. apt-cache: no node-floating-ui-react-dom, nothing Provides it, and it is not among the binaries of this package or of the NEW queue (checked 2026-11-05).
  • Problem: Every installed popper-based component (popover, tooltip, hover-card, menu, dropdown-menu, context-menu, menubar, navigation-menu) throws MODULE_NOT_FOUND on require, and so does the umbrella radix-ui module, which re-exports them; the package is therefore unusable for its main purpose. The autopkgtest (debian/tests/pkg-js/test) only checks that dist/index.js is non-empty, so neither the build nor the test notices.
  • Fix: Package @floating-ui/react-dom (as node-floating-ui-react-dom) and add it to Depends, or patch the popper-based components to drop it; then make debian/tests/pkg-js/test require() the installed modules so a missing dependency fails the test instead of passing silently.
minor packaging 3. Patch removes declaration-file generation, but the installed package.json exports still point at missing .d.ts files ◂
  • Files: debian/patches/remove-tsup.patch:81, internal/builder/builder.js:77-82, packages/react/accordion/package.json:16-30, debian/nodejs/build:20-45
  • Basis: checked, in the package or with a reference tool
  • Evidence: The patch deletes the tsup.build({... dts: { only: true } ...}) task and leaves only esbuild, whose config has no declaration step; the promoted exports keep "types": "./dist/index.d.ts" and "./dist/index.d.mts", and no .d.ts is produced anywhere under packages/.
  • Problem: The build no longer emits the type declarations upstream ships (tsup is not in Debian), yet the package.json exports advertise them, so TypeScript consumers get unresolvable types for every component and for radix-ui. node-typescript is even in Build-Depends, but no tsc run remains.
  • Fix: Emit declarations with tsc --emitDeclarationOnly in debian/nodejs/build (or drop the types entries from the promoted exports), so the metadata and the shipped files agree.
minor packaging 4. node-typescript and node-react-test-renderer are Build-Depends nothing uses, and node-react-test-renderer is also an unused Depends ◂
  • Files: debian/control:8-18, debian/control:27-31, debian/patches/remove-tsup.patch
  • Basis: checked, in the package or with a reference tool
  • Evidence: No build step runs tsc after the patch (all 62 packages build with "build": "radix-build", which runs esbuild only), and no file in the tree imports react-test-renderer (grep over packages/, scripts/, e2e/, apps/ finds it only in package.json devDependencies and pnpm-lock.yaml).
  • Problem: Superfluous dependencies slow the build and pull in packages the archive need not have installed; an unused runtime Depends is a user-visible metadata error (Policy 7.1).
  • Fix: Drop node-typescript from Build-Depends and node-react-test-renderer from both fields.
minor packaging 5. debian/rules deletes /usr/share/nodejs/primitives but dh-nodejs still advertises it as Provides: node-primitives (= 0.1.0) ◂
  • Files: debian/rules:6-7, package.json:3,5, debian/nodejs/root_modules:1
  • Basis: checked, in the package or with a reference tool
  • Evidence: rm -rf debian/node-radix-ui/usr/share/nodejs/primitives/ in execute_after_dh_auto_install removes the tree dh-nodejs installs for the root package (name primitives, version 0.1.0); the buildsystem adds node-primitives (= 0.1.0) to ${nodejs:Provides} for that main module, and at compat 14 dh_gencontrol applies that substvar to Provides automatically (debhelper 14 change log, "The dh_gencontrol tool now automatically applies relationship substvars").
  • Problem: The binary declares that it provides a module it does not ship, and the installation/removal pair is a hack that hides what dh-nodejs does. Nothing in the archive depends on node-primitives today, so the harm is limited to wrong metadata.
  • Fix: Avoid installing the root workspace as a module at all, or make its Provides not name a removed path (for example by overriding dh_nodejs_substvars or giving the root package a name whose self-provide is skipped), instead of installing and then deleting it.
Verified ◂
  • Prescan's WorkOS finding: the Files: * stanza names 2022-present WorkOS, matching LICENSE:3 and README.md:54 (and packages/react/radix-ui/README.md:36); this is the same holder, not an omission.
  • Covered the whole tree except .pc/: all 62 packages/*/package.json and colors/package.json declare "license": "MIT"; the only licence texts are LICENSE (2022 WorkOS) and colors/LICENSE (2021 Radix), and both are named in debian/copyright (the colors README lists Colm Tuite and Vlad Moroz, also named).
  • Searched the tree for GNU GPL/LGPL/Apache/MPL/BSD/public-domain/CC/non-commercial/All-rights-reserved wording: the only matches are coincidental (freebsd platform keys in pnpm-lock.yaml, hex colour values such as #0099cc). No non-free terms.
  • colors/index.js and colors/index.mjs are generated colour tables mirroring the shipped CSS (spot-checked grayDark against colors/gray-dark.css:2-13), so the preferred form for modification is present even though upstream's build-css-modules.js script is not in the npm tarball.
  • primitives.png, colors/colors.png, apps/ssr-testing/public/favicon.ico and apps/storybook/public/favicon{,-white}.svg are the project logo and favicons, covered by Files: * / colors/*; binary, not inspected.
  • No node_modules, prebuilt dist/ or generated .d.ts is present in the orig tarballs, and nothing is bundled into the built output: builder.js externalises every package (packages: 'external'), so @floating-ui/react-dom, aria-hidden and react-remove-scroll remain dependencies rather than embedded copies.
  • aria-hidden is provided by node-react-remove-scroll (= 1.2.6), which the binary Depends on, so no separate Depends is needed for the dialog/menu/popover/select imports.
  • All 62 workspace components are listed in debian/nodejs/root_modules, so none falls into the deleted main-module tree; debian/nodejs/additional_components is what makes dh-nodejs see them (the workspace is defined in pnpm-workspace.yaml, which dh-nodejs does not parse).
  • Patch remove-tsup.patch is the only patch, is in series, has a Description/Author/Forwarded header, and applies to internal/builder/builder.js as its header says.
  • uscan found the packaged version as the newest upstream release (upstream 1.6.7+~3.0.0, packaged 1.6.7+~3.0.0).
Not confirmed ◂
  • Vcs-Git/Vcs-Browser point at salsa.debian.org/js-team/node-primitives while the source package is node-radix-ui; whether that repository exists and is the intended one could not be checked.
  • CODE_OF_CONDUCT.md is an adaptation of Contributor Covenant 1.4 (attribution kept, no licence stated in the file, which upstream licenses CC BY 4.0); whether the adapted text can be distributed under the Expat terms claimed by Files: * cannot be settled from the package alone.
  • debian/tests/pkg-js/test only checks that dist/index.js is non-empty and never loads a module; whether the pkg-js autopkgtest runs it in the unpacked tree (where find packages matches) or in each installed module directory (where it would pass vacuously) could not be checked on this system.
Proposed changes ◂

None.

Uploader's response to the LLM review

Waiting for the uploader's response until , because the review found serious issues.

Back to Dashboard | View all reviews for this package