Review: node-replit-codemirror-indentation-markers 6.5.3-1

Package Information

Description	indentation guides for the CodeMirror text editor This extension draws vertical guides for indentation levels in CodeMirror. It can highlight the active indentation block and supports configurable guide colours, line thickness and handling of the first indentation level.
Maintainer	Home Assistant Team <team+homeassistant@tracker.debian.org>
Changed By	Edward Betts <edward@4angle.com>
Sponsor	edward@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/homeassistant-team/js/node-replit-codemirror-indentation-markers.git (browse)
Closes	#1152198
Tracker	https://tracker.debian.org/pkg/node-replit-codemirror-indentation-markers
Uploaded	12 days ago

New Package Report

.changes◂

Source	node-replit-codemirror-indentation-markers
Version	6.5.3-1
Changed-By	Edward Betts <edward@4angle.com>
Architecture	all source
Distribution	unstable
Date	Mon, 26 Oct 2026 19:32:54 +0000

Changelog◂

node-replit-codemirror-indentation-markers (6.5.3-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1152198)

.dsc◂

Package-List	node-replit-codemirror-indentation-markers deb javascript optional arch=all
Section	javascript
Priority	optional
Component	main

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: @replit/codemirror-indentation-markers
Upstream-Contact: Sergei Chestakov <me@sergei.com>
Source: https://github.com/replit/codemirror-indentation-markers

Files: *
Copyright: 2022 Replit
License: MIT

Files: debian/*
Copyright: 2026 Edward Betts <edward@4angle.com>
License: MIT

License: MIT
 Permission is hereby granted, free of charge, to any person obtaining a
 copy of this software and associated documentation files (the "Software"),
 to deal in the Software without restriction, including without limitation
 the rights to use, copy, modify, merge, publish, distribute, sublicense,
 and/or sell copies of the Software, and to permit persons to whom the
 Software is furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 DEALINGS IN THE SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 11 days ago.

Report◂

DFSG NEW review for node-replit-codemirror-indentation-markers version 6.5.3-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

All upstream files are MIT-licensed: LICENSE says "Copyright (c) 2022 Replit" with the standard MIT text, package.json declares "license": "MIT", and no source file carries any other licence or attribution. debian/copyright is DEP-5, has a Files: * stanza naming Replit (2022) and a later debian/* stanza naming Edward Betts, and reproduces the full MIT text, so the notice is preserved as MIT requires. The prescan's holder check found no missing holder, and I confirmed the only holder not in a Debian stanza (Sergei Chestakov) appears in package.json as author without any copyright claim, while the actual copyright notice names Replit. No vendored third-party code, prebuilt JavaScript, minified files or unlicensed assets are shipped.

Packaging

Straightforward pkg-js package: debhelper compat 14 with dh-nodejs, upstream's @codemirror/buildhelper replaced by debian/build.cjs using Debian's rollup/esbuild/tsc, documented in debian/README.source. debian/nodejs/{build,files,extlinks} are consistent with the source tree, dh-nodejs installs dist/ plus package.json, and the jsdom test runs both at build time and through autodep8 via Testsuite: autopkgtest-pkg-nodejs. Every Build-Depends name exists in the archive, Standards-Version 4.7.4 matches Policy 4.7.4.1, there are no patches or maintainer scripts, and the changelog is a sane initial release.

Issues

None.

Verified ◂

debian/copyright is machine-readable (correct Format URL) and read in full; Files: * (Replit, 2022, MIT) and the later debian/* stanza (Edward Betts, 2026, MIT) cover every path: the whole upstream tree including dev/, src/, public/, .gitignore, .replit, yarn.lock and the docs, and all of debian/.
LICENSE read in full: "MIT License / Copyright (c) 2022 Replit"; the MIT paragraph in debian/copyright matches it, and MIT is not in /usr/share/common-licenses so the full text is correctly present.
Grep of the whole tree for Copyright/(C)/©/SPDX/Licensed under/permission wording/GPL/LGPL/Apache/MPL/public domain/All rights reserved found notices only in LICENSE and debian/copyright; package.json's "license": "MIT" is consistent. The prescan's author check reported every holder named, which matches my reading.
public/cm-indentation-markers.png is the README's upstream screenshot; it is upstream material covered by Files: * and was not opened (binary).
yarn.lock is a Yarn v1 lockfile (registry URLs and integrity hashes), not vendored code; there is no node_modules, dist/, .class, .so or minified file in the tree.
Listed the .orig.tar.xz: its members match the unpacked tree exactly (dev/, public/, src/, config files, LICENSE, README.md, package.json, yarn.lock), so no prebuilt dist/ or other generated output is shipped and no Files-Excluded is needed. debian/README.source explains the tarball is a git checkout pinned to npm release 6.5.3's commit.
debian/control: compat 14, dh $@ with dh-nodejs, Section javascript, Architecture all, Multi-Arch foreign (consistent with node-crelt/node-rollup-plugin-dts), Vcs-* and Homepage present, Testsuite: autopkgtest-pkg-nodejs.
Package availability checked with apt-cache: rollup 3.30.0, esbuild 0.28.2 (Provides node-esbuild), node-typescript 6.0.3, node-rollup-plugin-json, node-rollup-plugin-node-resolve, node-rollup-plugin-dts, node-codemirror-language/state/view, node-crelt, node-jsdom; dh-sequence-nodejs-no-lerna is provided by dh-nodejs 0.17.14 and dh-sequence-single-binary by debhelper 14.5. No dependency name is bogus or unsatisfiable.
debian/build.cjs needs only rollup, @rollup/plugin-node-resolve, @rollup/plugin-json, esbuild, rollup-plugin-dts and tsc (node-typescript), all in Build-Depends; it reads debian/tsconfig.json, whose outDir/rootDir match the debian/types/index.d.ts path the script consumes, and debian/rules cleans dist/ and debian/types/.
Read dh-nodejs's buildsystem (/usr/share/perl5/Debian/Debhelper/Buildsystem/nodejs.pm): debian/nodejs/build is run for the build, debian/nodejs/files ("dist") selects installed files, package.json is installed automatically, and the build-time test runs debian/tests/pkg-js/test via sh -e.
No debian/tests/control is needed: /usr/share/autodep8/support/nodejs/{detect,generate} generate the pkg-js autopkgtest from Testsuite: autopkgtest-pkg-nodejs, with Depends including @builddeps@ (hence node-jsdom and node-crelt) and pkg-js-autopkgtest, which exists in the archive. Policy 5.6.30 confirms Testsuite may be set in debian/control in this situation.
Runtime deps match the source imports (@codemirror/language, state, view); node-crelt is listed because @codemirror/view uses it and node-codemirror-view's Depends does not name it (checked with apt-cache). nodejs:any is valid since nodejs is Multi-Arch: allowed.
No patches (no debian/patches, source format 3.0 (quilt)), no maintainer scripts or *.maintscript, no debian/install/links, debian/upstream/metadata has valid Bug-Database/Bug-Submit/Repository/Repository-Browse fields, changelog is a single 6.5.3-1 unstable entry closing the ITP.
Standards-Version 4.7.4: the installed Policy manual is 4.7.4.1 (read from /usr/share/doc/debian-policy/policy.txt.gz), so the first two components match and no issue arises.
uscan found the packaged version as the newest upstream release (upstream 6.5.3, packaged 6.5.3).

Not confirmed ◂

The package was not built and its tests not run (read-only review, no build permitted). In particular, the build-time jsdom test asserts two or more .cm-indent-markers lines; jsdom has no layout, so a build would show whether CodeMirror's viewport covers more than the first line there.
public/cm-indentation-markers.png was recorded but not opened, so its exact content is unverified (it is the upstream README screenshot).

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 11 days ago.

Review Information

accepted — allocated to mechtilde 11 days ago, started 11 days ago, completed 11 days ago.

Final Comment

Back to Dashboard | View all reviews for this package