Review: node-reflect-metadata 0.2.2~git20260824.acdeee4-1

Package Information

Description	polyfill for the ECMAScript Metadata Reflection API reflect-metadata provides a prototype implementation and polyfill for an ECMAScript Metadata Reflection API. It extends the global Reflect object with methods such as Reflect.metadata, Reflect.defineMetadata, Reflect.getMetadata, and Reflect.hasMetadata to declaratively or imperatively attach and introspect metadata on classes, methods, and properties. It is widely used by TypeScript and JavaScript projects that rely on decorator metadata (via TypeScript's --experimentalDecorators and --emitDecoratorMetadata options) for dependency injection, runtime type assertions, and reflection. Node.js is an event-based server-side JavaScript engine.
Maintainer	Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed By	Ying-Chun Liu (PaulLiu) <paulliu@debian.org>
Sponsor	paulliu@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/js-team/node-reflect-metadata.git (browse)
Closes	#1152958
Tracker	https://tracker.debian.org/pkg/node-reflect-metadata
Uploaded	13 hours ago

New Package Report

.changes◂

Changed-By	Ying-Chun Liu (PaulLiu) <paulliu@debian.org>
Architecture	source all
Distribution	unstable
Date	Thu, 05 Nov 2026 16:30:00 +0000
Source	node-reflect-metadata
Version	0.2.2~git20260824.acdeee4-1

Changelog◂

node-reflect-metadata (0.2.2~git20260824.acdeee4-1) unstable; urgency=low
 .
   * Initial release (Closes: #1152958)

.dsc◂

Section	javascript
Priority	optional
Component	main
Package-List	node-reflect-metadata deb javascript optional arch=all

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: reflect-metadata
Upstream-Contact: https://github.com/rbuckton/reflect-metadata/issues
Source: https://github.com/rbuckton/reflect-metadata

Files: *
Copyright: 2015-2024, Microsoft Corporation
2015-2024, Ron Buckton <ron.buckton@microsoft.com> (https://github.com/rbuckton)
License: Apache-2.0

Files: docs/*
Copyright: 2015 Nicolas Bevacqua
2016 Brian Terlson
License: MIT

Files: debian/*
Copyright: 2026, Ying-Chun Liu (PaulLiu) <paulliu@debian.org>
License: Apache-2.0

License: Apache-2.0
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
http://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
.
On Debian systems, the complete text of the Apache version 2.0 license
can be found in "/usr/share/common-licenses/Apache-2.0".

License: MIT
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
.
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

DFSG Assistant LLM REVIEW 1 blocker, 0 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 11 hours ago.

Report◂

DFSG NEW review for node-reflect-metadata version 0.2.2~git20260824.acdeee4-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 1 blocker, 0 important, 1 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

All licences in the tree are free and compatible: the polyfill and its type definitions are Apache-2.0, the ecmarkup assets under docs/ are MIT, and the MIT text is reproduced in debian/copyright. No non-free terms, missing licence or missing third-party holder were found. debian/copyright is, however, inaccurate for docs/: its Files: docs/* stanza gives the whole directory as MIT to the ecmarkup authors, while docs/index.html and docs/spec.biblio.json are generated from spec.html, which is Apache-2.0 material held by Microsoft and Ron Buckton.

Packaging

Standard dh-nodejs packaging for an arch:all JavaScript module: compat 13, one DEP-3 quilt patch, files installed through debian/nodejs/{build,files}, upstream tests run both at build time and through Testsuite: autopkgtest-pkg-nodejs, and a sane changelog and Vcs/Homepage. Build-Depends resolve in unstable, including the @types packages the patched tsconfigs need (nodejs, mocha and chai provide them), and Standards-Version 4.7.4 is current against Policy 4.7.4.1. One minor Build-Depends annotation is wrong: node-gulp-mocha is test-conditioned although gulp loads it for the build too.

Issues

blocker licensing 1. Files: docs/* claims MIT for the ecmarkup authors alone, but docs/index.html and docs/spec.biblio.json are generated from the Apache-2.0 spec.html ◂

Files: debian/copyright:11-15, docs/index.html:576-593, docs/spec.biblio.json:1, spec.html:14-16
Basis: checked, in the package or with a reference tool
Evidence: Files: docs/* / Copyright: 2015 Nicolas Bevacqua / 2016 Brian Terlson / License: MIT, while docs/index.html says // The following license applies to the fuzzysearch function before that MIT text, and spec.html's metadata says contributors: Ron Buckton.
Problem: docs/index.html is ecmarkup's rendering of spec.html (it loads ecmarkup.js and contains the whole Metadata Proposal), and spec.html is part of the repository's Apache-2.0 work, whose holder per Files: * is Microsoft/Ron Buckton. The MIT grant embedded in the generated page is explicitly limited to the fuzzysearch function. docs/spec.biblio.json is generated from the same spec. The stanza therefore states the wrong licence for these two files and drops their copyright holders, so the description does not satisfy copyright-format 1.0 section 6.7.
Fix: Restrict the MIT stanza to Files: docs/ecmarkup.js docs/ecmarkup.css (Bevacqua, Terlson); let Files: * describe docs/index.html and docs/spec.biblio.json as Apache-2.0 with Microsoft and Ron Buckton, adding a Comment (or License: Apache-2.0 and MIT) noting the MIT fuzzysearch function embedded in docs/index.html.

minor packaging 2. node-gulp-mocha is marked <!nocheck> although gulpfile.js requires it for the build, not only for the tests ◂

Files: debian/control:12-19, gulpfile.js:5, debian/nodejs/build:1
Basis: checked, in the package or with a reference tool
Evidence: const mocha = require("gulp-mocha"); at the top of gulpfile.js; node-gulp-mocha <!nocheck> in Build-Depends; debian/nodejs/build runs gulp build.
Problem: gulp loads the gulpfile and runs its top-level requires for every task, including gulp build, which is the build step here. With DEB_BUILD_OPTIONS=nocheck and DEB_BUILD_PROFILES=nocheck, Policy 4.9.2 drops <!nocheck> dependencies, while dh at compat 13 skips only dh_auto_test, so dh_auto_build still runs gulp build and fails with Cannot find module 'gulp-mocha'. The dependency is needed for the build.
Fix: Remove <!nocheck> from node-gulp-mocha, or move require("gulp-mocha") into the run:tests task so the build does not need it.

Verified ◂

Read all of debian/ except debian/watch (changelog, control, copyright, rules, clean, gbp.conf, source/format, nodejs/build, nodejs/files, patches/0001-gulp4-and-node-compat.patch and series, tests/pkg-js/{files,test}, upstream/metadata); .pc/ and debian/cargo-checksum.json do not exist.
Inventoried all 42 upstream files outside .pc/ and debian/; Reflect.ts, ReflectLite.ts, ReflectNoConflict.ts, globals.d.ts, index.d.ts, no-conflict.d.ts and standalone.d.ts carry Copyright (C) Microsoft. All rights reserved. with the Apache-2.0 notice, LICENSE and CopyrightNotice.txt are Apache-2.0, and no non-free wording, no other holder and no missing licence text were found.
docs/ecmarkup.js is the ecmarkup browser build with The MIT License (MIT) / Copyright © 2015 Nicolas Bevacqua / Copyright © 2016 Brian Terlson, which the docs/* stanza describes correctly; docs/ecmarkup.css has no notice and is treated as part of ecmarkup. docs/index.html and docs/spec.biblio.json are generated from spec.html, which is in the package (preferred form present); the whole docs/ directory is not installed in the binary package.
Reflect.js, ReflectLite.js and ReflectNoConflict.js are built during the build from the shipped .ts sources by debian/nodejs/build (gulp build) and removed by debian/clean, so no built artifact lacks its source.
The prescan's dfsg-author-check found no copyright holder missing from debian/copyright; I also grepped the tree for Copyright/(C)/©/SPDX/licence phrases and confirmed the only notices are Microsoft's Apache-2.0 headers, the MIT header in docs/ecmarkup.js and docs/index.html, and AUTHORS.md's contributor list (names not copyright claims).
Sampled the test sources (test/suites.ts, test/registry.ts, test/reflect-decorate.ts head); they are upstream's own tests, not imported from test262 or another licensed collection.
Testsuite: autopkgtest-pkg-nodejs with debian/tests/pkg-js/{files,test} is the standard pkg-js setup; the test reinstalls nothing and tests the installed module through /usr/share/nodejs/reflect-metadata.
The single patch in debian/patches/series carries DEP-3 fields (Description, Author, Forwarded: not-needed, Last-Update) and the tsconfig changes match the tool versions in the archive.
Standards-Version 4.7.4 against Policy 4.7.4.1 (policy tool) is current and not an issue; compat 13 and dh $@ with dh-sequence-nodejs are used correctly, including execute_after_dh_installdocs: dh_nodejs_autodocs for README/AUTHORS.
Every Build-Depends name exists in the archive (apt-cache): debhelper-compat 13, dh-nodejs 0.17.14 (Provides dh-sequence-nodejs), gulp 4.0.2, node-gulp-tsb 4.0.5, node-typescript 6.0.3, node-del 7.1.0, mocha 12.0.3 (Provides node-types-mocha), chai (Provides node-types-chai), nodejs (Provides node-types-node, i.e. /usr/share/nodejs/@types/node), so the absolute @types paths the patch puts in test/tsconfig.json are satisfied at build and test time.
Apache-2.0 and MIT are compatible in the single binary package, and the generated Reflect.js retains the Apache-2.0 copyright notice from Reflect.ts.
uscan found the packaged version as the newest upstream release (upstream 0.2.2~git20260824.acdeee4, packaged 0.2.2~git20260824.acdeee4).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

Whether Debian's node-del 7.1.0 can be loaded with require("del") as the patched gulpfile does: del is ESM-only upstream and node-del is not installed on this reviewing system, so I could not look at its shipped entry point; a build would show ERR_REQUIRE_ESM or Cannot find module at gulpfile load.
No build or test run was possible (read-only tree); whether gulp 4 plus mocha 12 satisfies gulp-mocha 8 was not exercised.
debian/watch looks at github.com/microsoft/reflect-metadata, but the Source field of debian/copyright names github.com/rbuckton/reflect-metadata. Whether these are the same upstream was not checked.
debian/watch looks at github.com/microsoft/reflect-metadata, but Repository in debian/upstream/metadata names github.com/rbuckton/reflect-metadata. Whether these are the same upstream was not checked.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader rejected this upload in response to the review.

Review Information

rejected — allocated to dfsg-uploader 10 hours ago, started 10 hours ago, completed 10 hours ago.

Final Comment

The uploader rejected this upload in response to the automated (LLM) review of it, so that they can fix the problems it found and upload again.

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
0.2.2-1	9e5f864d…	2026-11-05 04:11	2026-11-05 04:11	dfsg-uploader	rejected	VIEW
0.2.2-1	bd3d03bd…	2026-11-05 18:21	2026-11-05 18:21	dfsg-uploader	rejected	VIEW
0.2.2~git20260824.acdeee4-1	683b9801…	2026-11-06 17:45	2026-11-06 17:45	dfsg-uploader	rejected	VIEW
0.2.2~git20260824.acdeee4-1	80c2e404…	2026-11-07 04:15	2026-11-07 04:15	dfsg-uploader	rejected	VIEW
0.2.2~git20260824.acdeee4-1	255775e8…	2026-11-07 19:24	2026-11-07 19:26	mechtilde	accepted	VIEW

Back to Dashboard | View all reviews for this package