Review: node-reflect-metadata 0.2.2~git20260824.acdeee4-1

Package Information

Description	polyfill for the ECMAScript Metadata Reflection API reflect-metadata provides a prototype implementation and polyfill for an ECMAScript Metadata Reflection API. It extends the global Reflect object with methods such as Reflect.metadata, Reflect.defineMetadata, Reflect.getMetadata, and Reflect.hasMetadata to declaratively or imperatively attach and introspect metadata on classes, methods, and properties. It is widely used by TypeScript and JavaScript projects that rely on decorator metadata (via TypeScript's --experimentalDecorators and --emitDecoratorMetadata options) for dependency injection, runtime type assertions, and reflection. Node.js is an event-based server-side JavaScript engine.
Maintainer	Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed By	Ying-Chun Liu (PaulLiu) <paulliu@debian.org>
Sponsor	paulliu@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/js-team/node-reflect-metadata.git (browse)
Closes	#1152958
Tracker	https://tracker.debian.org/pkg/node-reflect-metadata
Uploaded	1 day ago

New Package Report

.changes◂

Changed-By	Ying-Chun Liu (PaulLiu) <paulliu@debian.org>
Architecture	source all
Distribution	unstable
Date	Thu, 05 Nov 2026 16:30:00 +0000
Source	node-reflect-metadata
Version	0.2.2~git20260824.acdeee4-1

Changelog◂

node-reflect-metadata (0.2.2~git20260824.acdeee4-1) unstable; urgency=low
 .
   * Initial release (Closes: #1152958)

.dsc◂

Section	javascript
Priority	optional
Component	main
Package-List	node-reflect-metadata deb javascript optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: reflect-metadata
Upstream-Contact: https://github.com/rbuckton/reflect-metadata/issues
Source: https://github.com/rbuckton/reflect-metadata

Files: *
Copyright: 2015-2024, Microsoft Corporation
2015-2024, Ron Buckton <ron.buckton@microsoft.com> (https://github.com/rbuckton)
License: Apache-2.0

Files: docs/ecmarkup.js
docs/index.html
Copyright: 2015 Nicolas Bevacqua
2016 Brian Terlson
License: MIT

Files: debian/*
Copyright: 2026, Ying-Chun Liu (PaulLiu) <paulliu@debian.org>
License: Apache-2.0

License: Apache-2.0
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
http://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
.
On Debian systems, the complete text of the Apache version 2.0 license
can be found in "/usr/share/common-licenses/Apache-2.0".

License: MIT
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
.
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

DFSG Assistant LLM REVIEW 1 blocker, 0 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 day ago.

Report◂

DFSG NEW review for node-reflect-metadata version 0.2.2~git20260824.acdeee4-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 1 blocker, 0 important, 1 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

Every licence found is free: the upstream code and debian/ are Apache-2.0 (LICENSE, CopyrightNotice.txt, per-file Microsoft headers, package.json), and the ecmarkup assets in docs/ are MIT. There is no DFSG problem. debian/copyright is DEP-5 with the exact Format URL, the right short names and licence texts, and it matches the holder notices in the tree; but it does not cover docs/ecmarkup.css, which is left to Files: * and therefore described as Microsoft's Apache-2.0 code although it is the ecmarkup stylesheet, the same third-party MIT asset as the docs/ecmarkup.js it does list. The pre-review scan listed no files and found no unmatched holder.

Packaging

Packaging is clean and follows current Debian JS team practice: compat 13 with dh-sequence-nodejs, the build done from TypeScript with debian/nodejs/build, a single DEP-3 patch, autopkgtest-pkg-nodejs with debian/tests/pkg-js, Architecture: all with Multi-Arch: foreign, Rules-Requires-Root: no, and Standards-Version 4.7.4 (same first two components as the reviewing system's Policy 4.7.4.1). All Build-Depends names exist in the archive, the test-only ones are marked <!nocheck>, and no maintainer scripts are needed. One minor omission: standalone.d.ts, which the installed README tells browser users to reference, is not in debian/nodejs/files.

Issues

blocker licensing 1. Files: * describes docs/ecmarkup.css as Microsoft's Apache-2.0 code, but it is the ecmarkup MIT stylesheet ◂

Files: debian/copyright, docs/ecmarkup.css, docs/ecmarkup.js, docs/index.html
Basis: inferred from what was read, not seen directly
Evidence: Files: * ... License: Apache-2.0 is the only stanza matching docs/ecmarkup.css; the MIT stanza above it is Files: docs/ecmarkup.js / docs/index.html. docs/ecmarkup.css carries no copyright or licence header; it is the stylesheet loaded as ecmarkup.css by spec.html and docs/index.html, next to docs/ecmarkup.js.
Problem: By copyright-format 6.9 the last matching stanza wins, so docs/ecmarkup.css is attributed to Microsoft Corporation under Apache-2.0. It is not Microsoft's code: it is the ecmarkup tool's stylesheet, the same third-party asset as docs/ecmarkup.js, which debian/copyright itself lists under MIT with the 2016 Brian Terlson copyright taken from the notice inside that file. The copyright file therefore misstates both the holder and the licence of that source file, and does not reproduce its MIT notice.
Fix: Add docs/ecmarkup.css to the existing MIT stanza (or give it its own Files stanza) with ecmarkup's copyright holder and the MIT licence.

minor packaging 2. standalone.d.ts, which the installed README tells browser users to reference, is not installed ◂

Files: debian/nodejs/files, standalone.d.ts, README.md
Basis: checked, in the package or with a reference tool
Evidence: debian/nodejs/files installs only package.json, Reflect.js, ReflectLite.js, ReflectNoConflict.js, index.d.ts and no-conflict.d.ts. README.md line 60: /// <reference path="path/to/reflect-metadata/standalone.d.ts" />, and dh_nodejs_autodocs installs README.md into the package's documentation (debian/ has no docs file).
Problem: standalone.d.ts supplies the ambient Reflect typings for the browser <script> usage that the README documents. It exists in the source and in the npm package, but the Debian package's explicit file list omits it, so users following the shipped README cannot find the file; the browser use case is broken in the binary package.
Fix: Add standalone.d.ts to debian/nodejs/files.

Verified ◂

The pre-review scan reported no unmatched copyright holder and listed no files to account for; the five holders in debian/copyright (Microsoft, Ron Buckton, Nicolas Bevacqua, Brian Terlson, Ying-Chun Liu) match the notices found.
Read debian/copyright in full: it is DEP-5 with the exact Format URL, stanzas Files: , the docs MIT stanza and debian/, Apache-2.0 and MIT short names, complete MIT text, and a pointer to /usr/share/common-licenses/Apache-2.0.
Read LICENSE (full Apache-2.0), CopyrightNotice.txt (Microsoft, Apache-2.0) and AUTHORS.md (Cy Brown, Oleh Dokuka, Ron Buckton, William Buchwalter). AUTHORS.md is an authorship list, not a copyright notice, and the source headers name Microsoft.
Searched every file in the tree for Copyright/(C)/©/SPDX/licence wording. Reflect.ts, ReflectLite.ts, ReflectNoConflict.ts, globals.d.ts, index.d.ts, no-conflict.d.ts, standalone.d.ts, gulpfile.js, tsconfig*.json, test/*.ts, spec.html and the dotfiles carry the Microsoft Apache-2.0 header or fall under Files: *; nothing else is claimed by a third party except the docs assets.
docs/ecmarkup.js and docs/index.html contain the MIT notice (2015 Nicolas Bevacqua, 2016 Brian Terlson) that the MIT stanza quotes. docs/index.html is built from spec.html, which is present; docs/spec.biblio.json is ecmarkup's JSON index of that spec and is covered by Files: *.
Read all of debian/: control, rules, changelog (unstable, initial release closing #1152958), clean, gbp.conf, source/format (3.0 quilt), patches/series and 0001-gulp4-and-node-compat.patch (DEP-3 headers, Forwarded: not-needed, Last-Update), nodejs/build (gulp build), nodejs/files, tests/pkg-js/files and tests/pkg-js/test, upstream/metadata. The patch is applied (present in .pc) and the built files it produces are exactly those listed in debian/nodejs/files and removed by debian/clean.
Checked against the archive that dh-nodejs provides both dh-sequence-nodejs and dh_nodejs_autodocs, and that gulp 4.0.2, node-del, node-gulp-tsb, node-gulp-mocha, chai, mocha, node-typescript and libnode-dev exist; chai/mocha provide the @types/chai and @types/mocha paths the patched test/tsconfig.json uses, and nodejs (pulled in by dh-nodejs) provides @types/node.
Testsuite: autopkgtest-pkg-nodejs needs no debian/tests/control: the autodep8 nodejs profile generates tests with Depends: @, @builddeps@, pkg-js-autopkgtest, so gulp/mocha/chai/typescript are available in the test environment.
Standards-Version 4.7.4 shares its first two components with the reviewing system's Policy 4.7.4.1, so it is not an issue.
No maintainer scripts or *.maintscript; Architecture: all with Multi-Arch: foreign; the binary Depends on ${misc:Depends} only, which is right for an arch:all JavaScript module at compat 13 (compare node-tslib, which has no Depends at all).
No binary blobs: every file is text (TypeScript, JavaScript, JSON, HTML, CSS, Markdown). The only built or vendored assets are docs/index.html, docs/ecmarkup.js and docs/ecmarkup.css; the first has its source spec.html in the tree and the other two are ecmarkup's client assets, whose notices the copyright file should cover.
uscan found the packaged version as the newest upstream release (upstream 0.2.2~git20260824.acdeee4, packaged 0.2.2~git20260824.acdeee4).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

Could not build the package or run its tests in this read-only review; no build or test failure is claimed.
Could not confirm ecmarkup's own licence text from the reviewing system (no ecmarkup package is installed or in the archive lists); the finding rests on the file's provenance next to docs/ecmarkup.js and on debian/copyright's own MIT treatment of that companion file.
Could not verify the ITP number #1152958 or the Salsa Vcs repository over the network.
debian/watch looks at github.com/microsoft/reflect-metadata, but the Source field of debian/copyright names github.com/rbuckton/reflect-metadata. Whether these are the same upstream was not checked.
debian/watch looks at github.com/microsoft/reflect-metadata, but Repository in debian/upstream/metadata names github.com/rbuckton/reflect-metadata. Whether these are the same upstream was not checked.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader rejected this upload in response to the review.

Review Information

rejected — allocated to dfsg-uploader 23 hours ago, started 23 hours ago, completed 23 hours ago.

Final Comment

The uploader rejected this upload in response to the automated (LLM) review of it, so that they can fix the problems it found and upload again.

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
0.2.2-1	9e5f864d…	2026-11-05 04:11	2026-11-05 04:11	dfsg-uploader	rejected	VIEW
0.2.2-1	bd3d03bd…	2026-11-05 18:21	2026-11-05 18:21	dfsg-uploader	rejected	VIEW
0.2.2~git20260824.acdeee4-1	683b9801…	2026-11-06 17:45	2026-11-06 17:45	dfsg-uploader	rejected	VIEW
0.2.2~git20260824.acdeee4-1	861a19a4…	2026-11-07 16:28	2026-11-07 16:28	dfsg-uploader	rejected	VIEW
0.2.2~git20260824.acdeee4-1	255775e8…	2026-11-07 19:24	2026-11-07 19:26	mechtilde	accepted	VIEW

Back to Dashboard | View all reviews for this package