Review: node-reflect-metadata 0.2.2-1
Package Information
| Description | polyfill for the ECMAScript Metadata Reflection API reflect-metadata provides a prototype implementation and polyfill for an ECMAScript Metadata Reflection API. It extends the global Reflect object with methods such as Reflect.metadata, Reflect.defineMetadata, Reflect.getMetadata, and Reflect.hasMetadata to declaratively or imperatively attach and introspect metadata on classes, methods, and properties. It is widely used by TypeScript and JavaScript projects that rely on decorator metadata (via TypeScript's --experimentalDecorators and --emitDecoratorMetadata options) for dependency injection, runtime type assertions, and reflection. Node.js is an event-based server-side JavaScript engine. |
|---|---|
| Maintainer | Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org> |
| Changed By | Ying-Chun Liu (PaulLiu) <paulliu@debian.org> |
| Sponsor | paulliu@debian.org |
| Distribution | unstable |
| Architecture | all |
| VCS | git: https://salsa.debian.org/js-team/node-reflect-metadata.git (browse) |
| Closes | #1152958 |
| Tracker | https://tracker.debian.org/pkg/node-reflect-metadata |
| Uploaded | 2 days ago |
New Package Report
.changes
| Version | 0.2.2-1 |
|---|---|
| Changed-By | Ying-Chun Liu (PaulLiu) <paulliu@debian.org> |
| Architecture | source all |
| Distribution | unstable |
| Date | Tue, 03 Nov 2026 20:45:18 +0000 |
| Source | node-reflect-metadata |
Changelog
node-reflect-metadata (0.2.2-1) unstable; urgency=low . * Initial release (Closes: #1152958)
.dsc
| Priority | optional |
|---|---|
| Component | main |
| Package-List | node-reflect-metadata deb javascript optional arch=all |
| Section | javascript |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: reflect-metadata
Upstream-Contact: https://github.com/rbuckton/reflect-metadata/issues
Source: https://github.com/rbuckton/reflect-metadata
Files: *
Copyright: 2015-2024 Microsoft Corporation
2015-2024 Ron Buckton <ron.buckton@microsoft.com> (https://github.com/rbuckton)
License: Apache-2.0
Files: debian/*
Copyright: 2026, Ying-Chun Liu (PaulLiu) <paulliu@debian.org>
License: Apache-2.0
License: Apache-2.0
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
http://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
.
On Debian systems, the complete text of the Apache version 2.0 license
can be found in "/usr/share/common-licenses/Apache-2.0".
DFSG Assistant LLM REVIEW 1 blocker, 0 important, 0 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 2 days ago.
Report
DFSG NEW review for node-reflect-metadata version 0.2.2-1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: No - Packaging is of good quality: Yes
- Issues: 1 blocker, 0 important, 0 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: nothing found
Licensing
The licence itself is fine: every upstream file is Apache-2.0 with Microsoft notices, the full LICENSE is in the tarball, and debian/copyright (DEP-5) matches holders and licence. The tarball, however, is the npm distribution and contains only the TypeScript compiler's output for the three JavaScript modules, with no TypeScript implementation sources and no build configuration, so the source package does not carry the preferred form for modification (DFSG 2, Policy 2.2.1).
Packaging
The debian/ directory is small and correct: debhelper compat 13 with dh-sequence-nodejs, a valid autopkgtest-pkg-nodejs test, sensible Multi-Arch/Section/Architecture, current Standards-Version, Vcs fields, a clean initial changelog, and a correct DEP-5 copyright file. No packaging issue worth reporting.
Issues
blocker licensing 1. Source tarball holds only compiler output: the TypeScript sources and build files of Reflect.js, ReflectLite.js and ReflectNoConflict.js are missing ◂
- Files:
Reflect.js,ReflectLite.js,ReflectNoConflict.js,index.d.ts,package.json - Basis: inferred from what was read, not seen directly
- Evidence: package.json:
"build": "gulp build","prepublishOnly": "gulp prepublish", devDependencies"gulp-tsb": "^2.0.3","typescript": "^2.1.4"; ReflectNoConflict.js:16Object.defineProperty(exports, "__esModule", { value: true });; the tarball contains 11 files and no*.tsimplementation, no gulpfile.js and no tsconfig.json. - Problem: The three shipped JavaScript modules are output of the TypeScript compiler (the
__esModulemarker and the gulp-tsb/typescript build setup in package.json show it), and the .d.ts files are declaration output of the same sources. Their sources and the generator inputs are not in the package, so what Debian ships is compiled/object form only: the package cannot be rebuilt or meaningfully modified from what is distributed. That is a DFSG 2 and Policy 2.2.1 (source code is the preferred form for modification) violation. - Fix: Repack from the upstream GitHub repository (which carries the TypeScript sources and the gulp/tsconfig build files) instead of the npm registry tarball, so the .ts implementation and build configuration are in the .orig tarball, and generate the .js at build time or ship both. Add any new files/holders to debian/copyright if the repack brings them in.
Verified ◂
- Read all 11 files of the upstream tarball and their licence headers: every file carries
Copyright (C) Microsoft. All rights reserved.andLicensed under the Apache License, Version 2.0; LICENSE is the full Apache-2.0 text. No other holder, no vendored third-party code, no non-free wording, no minified or binary files. - The prescan listed no files or missing holders to account for; its author check reported that every holder found is named in debian/copyright.
- AUTHORS.md lists Cy Brown, Oleh Dokuka, Ron Buckton and William Buchwalter as authors, but no copyright notice names them (all notices say Microsoft), so no holder is omitted from debian/copyright.
- debian/copyright is DEP-5 with the correct Format URL;
Files: *(2015-2024 Microsoft Corporation) is followed byFiles: debian/*(2026 PaulLiu), so later-stanza override covers debian/; short name Apache-2.0 and the /usr/share/common-licenses/Apache-2.0 pointer are correct, so no full-text copy is needed. - debian/tests/pkg-js/test is run at build time by the nodejs debhelper buildsystem as
/bin/sh -ex debian/tests/pkg-js/testin the build directory (sub test in /usr/share/perl5/Debian/Debhelper/Buildsystem/nodejs.pm), so itsrequire("./Reflect*.js")paths resolve. - debian/control: debhelper-compat 13; dh-sequence-nodejs is a virtual package provided by dh-nodejs 0.17.14 (apt-cache); dh-nodejs is real; ${misc:Depends} present, which is required below compat 14; Standards-Version 4.7.4 matches Policy 4.7.4.1; Architecture all, Multi-Arch foreign, Section javascript, Vcs-* and Rules-Requires-Root present.
- dh_nodejs_autodocs exists in /usr/bin (dh-nodejs) and installs README.md, AUTHORS.md and CopyrightNotice.txt into /usr/share/doc/node-reflect-metadata;
execute_after_dh_installdocsis a valid dh hook at compat 13. - No debian/patches, no maintainer scripts; debian/source/format is 3.0 (quilt); changelog is an initial release closing #1152958 with a current date; debian/upstream/metadata and gbp.conf are consistent.
- No nodejs dependency is declared in Depends, which matches other pure Node library packages in the archive (e.g. node-minimist, node-jsonify), so this was not reported as a missing dependency.
- Ignored .pc/ throughout as instructed.
- uscan found the packaged version as the newest upstream release (upstream
0.2.2, packaged0.2.2). - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (Apache-2.0).
Not confirmed ◂
- The autopkgtest-pkg-nodejs runner is not installed on the reviewing system, so how it invokes debian/tests/pkg-js/test (working directory) could not be checked; the build-time invocation was checked.
- The file names and layout of the missing upstream TypeScript sources could not be checked, as no upstream repository is reachable from the review.
Proposed changes ◂
None.
Uploader's response to the LLM review
The uploader rejected this upload in response to the review.
Review Information
rejected — allocated to dfsg-uploader 2 days ago, started 2 days ago, completed 2 days ago.
Final Comment
The uploader rejected this upload in response to the automated (LLM) review of it, so that they can fix the problems it found and upload again.
Other Reviews of this Package
| Version | Hash | Allocated | Completed | Reviewer | Status | Details |
|---|---|---|---|---|---|---|
| 0.2.2-1 | 9e5f864d… | 2026-11-05 04:11 | 2026-11-05 04:11 | dfsg-uploader | rejected | VIEW |
| 0.2.2~git20260824.acdeee4-1 | 683b9801… | 2026-11-06 17:45 | 2026-11-06 17:45 | dfsg-uploader | rejected | VIEW |
| 0.2.2~git20260824.acdeee4-1 | 80c2e404… | 2026-11-07 04:15 | 2026-11-07 04:15 | dfsg-uploader | rejected | VIEW |
| 0.2.2~git20260824.acdeee4-1 | 861a19a4… | 2026-11-07 16:28 | 2026-11-07 16:28 | dfsg-uploader | rejected | VIEW |
| 0.2.2~git20260824.acdeee4-1 | 255775e8… | 2026-11-07 19:24 | 2026-11-07 19:26 | mechtilde | accepted | VIEW |