node-radix-ui 1.6.7+~3.0.0-1

Package Information

Description	UI component library for building high-quality accessible design Radix Primitives is a low-level UI component library focused on accessibility, customization and developer experience. You can use these components either as the base of your design system, or adopt them incrementally. This package provids the complete collection of Radix UI React components and primitives for Node.js environments.
Maintainer	Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed By	Andrew Lee (李健秋) <ajqlee@debian.org>
Sponsor	ajqlee@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/js-team/node-primitives.git (browse)
Closes	#1151391
Blocked Bugs	#1093255 (wishlist)
Tracker	https://tracker.debian.org/pkg/node-radix-ui
Uploaded	1 day ago

New Package Report

.changes◂

Changed-By	Andrew Lee (李健秋) <ajqlee@debian.org>
Architecture	source all
Distribution	unstable
Date	Mon, 19 Oct 2026 12:46:11 +0200
Source	node-radix-ui
Version	1.6.7+~3.0.0-1

Changelog◂

node-radix-ui (1.6.7+~3.0.0-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1151391)

.dsc◂

Section	javascript
Priority	optional
Component	main
Package-List	node-radix-ui deb javascript optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: Radix Primitives
Comment: name is node-radix-ui to match it's name on npmjs.org.

Files: *
Copyright: 2022-present WorkOS
License: Expat

Files: .changeset/changelog.cjs
Copyright: Copyright (c) Diego Haz
License: Expat

Files: packages/core/primitive/src/primitive.tsx
Copyright: Copyright (c) AriaKit
License: Expat

Files: packages/core/rect/src/observe-element-rect.ts
Copyright: Copyright (c) React Training
License: Expat

Files: packages/react/menu/src/menu.tsx packages/react/tooltip/src/tooltip.tsx
Copyright: substack / James Halliday
License: Expat
Comment: substack upstream github repo get 404 error. Copyright info from LICENSE file on npm.

Files: colors/*
Copyright: 2021 Radix
                Colm Tuite
                Vlad Moroz
License: Expat

Files: debian/*
Copyright: Andrew Lee (李健秋) <ajqlee@debian.org>
License: Expat

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 2 important, 4 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 day ago.

Report◂

DFSG NEW review for node-radix-ui version 1.6.7+~3.0.0-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: No
Issues: 0 blocker, 2 important, 4 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The code is MIT (Expat) throughout and DFSG-free: the root LICENSE (2022 WorkOS), colors/LICENSE (2021 Radix) and every package.json say MIT, and the AriaKit, React Training, point-in-polygon and Diego Haz notices are all matched by stanzas with the full Expat text. Two things stop a plain yes: the colors/ component is the npm-published tarball (root directory package/) whose index.js, index.mjs and types/*.d.ts are build output whose TypeScript sources are not in the source package, and the overriding stanzas for the files with borrowed code drop the WorkOS copyright those files also carry (DEP-5 6.8).

Packaging

Modern, clean packaging (compat 14, dh-sequence-nodejs + single-binary, 3.0 quilt, one DEP-3 patch, autopkgtest-pkg-nodejs, Standards-Version 4.7.4 which matches Policy 4.7.4.1). It is not ready, though: the built modules import @floating-ui/react-dom (esbuild keeps every bare import external), which is in neither Depends nor any Debian binary package, so the popper-based components fail to load on installation; Vcs-* also name a repository other than the source package, and the patch that removes tsup leaves the advertised types files ungenerated.

Issues

important licensing 1. colors/ is the npm-published package; index.js, index.mjs and types/*.d.ts are build output whose sources are missing ◂

Files: colors/package.json:9-13, colors/index.js, colors/index.mjs, colors/types/index.d.ts, colors/types/light.d.ts
Basis: checked, in the package or with a reference tool
Evidence: The component tarball node-radix-ui_1.6.7+~3.0.0.orig-colors.tar.xz has a single top-level entry package/ (the layout of an npm pack tarball, not a git archive). colors/package.json: "main": "index.js", "module": "index.mjs", "build": "yarn clean && yarn && rollup -c && yarn build-css-modules", "build-css-modules": "node ./scripts/build-css-modules.js", "prepublishOnly": "yarn build"; no src/, no scripts/, no rollup config is present in the tree.
Problem: index.js and index.mjs are rollup output and types/*.d.ts are output of scripts/build-css-modules.js, as the package's own scripts say, but the TypeScript palette sources and the generator scripts are absent. DFSG 2 requires the preferred form for modification, and these files are installed into the binary (@radix-ui/colors is in debian/nodejs/additional_components). The colour data itself is present in the .css files, which limits the practical harm, but the component is not upstream source.
Fix: Fetch the colors component from the radix-ui/colors 3.0.0 git tag (which carries src/, scripts/ and the rollup configuration) instead of the npm tarball, or drop the prebuilt index.js/index.mjs/types/*.d.ts and rebuild them from shipped sources.

important packaging 2. Depends omits @floating-ui/react-dom, which the built popper and every component using it require at runtime ◂

Files: debian/control:27-32, packages/react/popper/src/popper.tsx:12, packages/react/popper/package.json:47-56, internal/builder/builder.js:63-65
Basis: checked, in the package or with a reference tool
Evidence: builder.js: external: ['@radix-ui/*'], packages: 'external', bundle: true; popper.tsx:12 } from '@floating-ui/react-dom';; debian/control Depends: ${nodejs:Depends}, node-react, node-react-dom, node-react-test-renderer, node-react-remove-scroll. apt-cache show finds no package for node-floating-ui-react-dom (or any node-floating-ui-*), and nothing provides or ships it, including this upload and the NEW queues. dh_nodejs_substvars and the nodejs buildsystem set only nodejs:Provides/nodejs:BuiltUsing/nodejs:Version, never a ${nodejs:Depends} value.
Problem: esbuild leaves all bare imports external, so the installed @radix-ui/react-popper (and popover, tooltip, menu, dropdown-menu, menubar, select, hover-card, context-menu, navigation-menu) does require('@floating-ui/react-dom'). Nothing installs that module and Depends does not name it, so loading any of those components fails with Cannot find module '@floating-ui/react-dom'; Depends must list every package a module needs at runtime (Policy 7.1).
Fix: Package @floating-ui/react-dom (node-floating-ui-react-dom) and add it to Depends; no Build-Depends entry is needed because esbuild does not resolve it.

minor licensing 3. Overriding Files stanzas drop the WorkOS copyright of menu.tsx, tooltip.tsx, primitive.tsx and observe-element-rect.ts ◂

Files: debian/copyright:13-19, debian/copyright:21-23, packages/react/menu/src/menu.tsx:1314, packages/react/tooltip/src/tooltip.tsx:677, packages/core/primitive/src/primitive.tsx:42-43, packages/core/rect/src/observe-element-rect.ts:1-2
Basis: checked, in the package or with a reference tool
Evidence: Files: packages/react/menu/src/menu.tsx packages/react/tooltip/src/tooltip.tsx / Copyright: substack / James Halliday; menu.tsx:1314 and tooltip.tsx:677 only say // Based on https://github.com/substack/point-in-polygon; primitive.tsx:43 * MIT License, Copyright (c) AriaKit.; observe-element-rect.ts:1-2 // Adapted from ... / // MIT license, React Training. The top-level LICENSE is Copyright (c) 2022 WorkOS.
Problem: These stanzas override Files: *, so the WorkOS (Radix) copyright that also covers these Radix-authored files is no longer declared for them. DEP-5 6.8 requires the Copyright field of a Files stanza to collect all notices that apply to the files it matches; here a few borrowed functions make the whole file look third-party.
Fix: Add 2022-present WorkOS to the Copyright field of each of these stanzas (and of the primitive.tsx / observe-element-rect.ts stanzas), keeping the third-party holder as a second line.

minor packaging 4. debian/patches/remove-tsup.patch removes .d.ts generation, leaving package.json types entries pointing at files that are never built ◂

Files: debian/patches/remove-tsup.patch:27-36, internal/builder/builder.js:57-83, packages/react/menu/package.json:11-20, debian/nodejs/build:20-32
Basis: checked, in the package or with a reference tool
Evidence: The patch deletes tsup.build({ ... dts: { only: true } ... }) and the comment tsup is used to emit d.ts files only (esbuild can't do that); after it, builder.js only runs two esbuild builds, which cannot emit declarations. Each package.json still advertises "types": "./dist/index.d.ts" / "./dist/index.d.mts", and debian/nodejs/build promotes those publishConfig.exports to top-level exports.
Problem: The installed modules keep types/exports.types paths for declaration files that are never produced, so TypeScript consumers get broken type resolution, and the public API loses the declarations upstream publishes. node-typescript is already in Build-Depends but unused.
Fix: Emit declarations in the Debian build (e.g. tsc --emitDeclarationOnly per package) or drop the types entries from the rewritten package.json in debian/nodejs/build.

minor packaging 5. Vcs-Browser and Vcs-Git point at salsa repository node-primitives, not the node-radix-ui source package ◂

Files: debian/control:21-22
Basis: inferred from what was read, not seen directly
Evidence: Vcs-Browser: https://salsa.debian.org/js-team/node-primitives / Vcs-Git: https://salsa.debian.org/js-team/node-primitives.git, while the source package, its upstream tarballs and debian/copyright's Comment all use the name node-radix-ui.
Problem: A Vcs field that does not name the repository holding this packaging misleads dgit, vcswatch and reviewers; the js-team names its repositories after the source package.
Fix: Correct both fields to https://salsa.debian.org/js-team/node-radix-ui(.git), or point them at whatever repository actually holds the packaging.

minor packaging 6. Depends includes node-react-test-renderer, which no shipped module imports ◂

Files: debian/control:31, package.json:58
Basis: checked, in the package or with a reference tool
Evidence: node-react-test-renderer is in Depends; react-test-renderer appears in the tree only as the root workspace devDependency (package.json:58, with @types/react-test-renderer at :46) and in pnpm-workspace.yaml; a grep of packages///src finds no import of it.
Problem: It is a test-only dependency of the upstream workspace, so every installation of the library pulls a package it never loads (Policy 7.1: Depends should list what is needed at runtime).
Fix: Drop node-react-test-renderer from the binary package's Depends.

Verified ◂

Read every file under debian/ in full (control, copyright, rules, changelog, gbp.conf, salsa-ci.yml, source/format, nodejs/{build,additional_components,extlinks,root_modules}, patches/{series,remove-tsup.patch}, tests/pkg-js/{files,test}, upstream/metadata) plus the .dsc; debian/watch not reviewed.
Inventory of the 798 scanned files: 65 packages under packages/core and packages/react, apps/{storybook,ssr-testing}, e2e/, internal/{builder,test-data,test-utils,typescript-config}, scripts/, types/, .changeset/, .github/ and the colors/ component; no dist/, node_modules/, minified JS, archives, PDFs or fonts in the tree.
Licence evidence grepped across the whole tree (Copyright, ©, SPDX-License-Identifier, Licensed under, MIT, Apache, GPL/LGPL, MPL, BSD, ISC, CC, Unlicense, public domain, All rights reserved, non-commercial, NoDerivatives, 'Good, not Evil'): only MIT/Expat appears, in the root LICENSE, colors/LICENSE and every package.json; no non-free or no-modification terms anywhere.
Every notice found has a stanza: Diego Haz (.changeset/changelog.cjs:2), AriaKit (packages/core/primitive/src/primitive.tsx:43), React Training (packages/core/rect/src/observe-element-rect.ts:2), point-in-polygon/James Halliday (menu.tsx:1314, tooltip.tsx:677), Radix/Colm Tuite/Vlad Moroz (colors/LICENSE, colors/package.json contributors). All use Expat, whose full text is in the copyright file's stand-alone License paragraph.
Prescan item WorkOS (README.md:54 and packages/react/radix-ui/README.md:36, both 'Copyright © 2022-present WorkOS') is covered by the Files: * stanza, which names WorkOS; the prescan found no other unrepresented holder.
File-pattern matching checked against DEP-5 6.9: Files: * catches everything, and the later stanzas (.changeset/changelog.cjs, the four source files, colors/, debian/) correctly override it; Files: colors/* reaches colors/types/* at any depth.
Images recorded but not opened, judged from their place and documentation: primitives.png and colors/colors.png are the two projects' own logos/screenshots, apps/ssr-testing/public/favicon.ico and apps/storybook/public/favicon.png are site assets; all are covered by the Expat stanzas and no third-party provenance is claimed anywhere in the tree.
Packaging mechanics checked against the reference tools: dh-sequence-nodejs is provided by dh-nodejs 0.17.14 and dh-sequence-single-binary by debhelper 14.5 (apt-cache); nodejs:Depends is generated by nothing (read /usr/bin/dh_nodejs_substvars and Buildsystem/nodejs.pm); aria-hidden is provided by node-react-remove-scroll 2.7.2+~cs7.11.40410850-1, so no separate dependency is missing for it; esbuild, node-glob, node-playwright and node-typescript exist.
Testsuite: autopkgtest-pkg-nodejs with debian/tests/pkg-js/{files,test} and no debian/tests/control is the documented use of pkg-js-autopkgtest, so not a fault.
Standards-Version 4.7.4 against Policy 4.7.4.1: current (first two components match), not an issue. Changelog version 1.6.7+~3.0.0-1, distribution unstable, initial upload closing #1151391: sane. The single patch has DEP-3 headers (Description, Author, Forwarded: not-needed).
uscan found the packaged version as the newest upstream release (upstream 1.6.7+~3.0.0, packaged 1.6.7+~3.0.0).

Not confirmed ◂

CODE_OF_CONDUCT.md says it 'is adapted from the Contributor Covenant, version 1.4' (Contributor Covenant is published under CC BY 4.0), while debian/copyright covers it with Files: * / Expat alone; I could not check the v1.4 licence text offline, so did not report it as an issue. A stanza naming the adaptation would be safest.
The build was not run: the missing-@floating-ui/unusable-component conclusion rests on builder.js keeping bare imports external and on apt-cache finding no provider, not on observing a failed require.
debian/tests/pkg-js/test only asserts that each packages/*/dist/index.js is non-empty; whether the pkg-js-autopkgtest testbed has the build-tree dist/ at all could not be checked (pkg-js-autopkgtest is not installed here), so its coverage is unclear.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader hasn't responded yet, and is welcome to at any time. The 24-hour hold has ended, so the package is now open for review as usual.

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
1.6.7+~3.0.0-1	10255ea2…	2026-11-06 09:10	2026-11-06 09:10	dfsg-uploader	rejected	VIEW

Back to Dashboard | View all reviews for this package