node-temporal-polyfill 1.0.6-1

Package Information

Description	polyfill for the JavaScript Temporal date and time API Temporal provides objects for dates, times, time zones and durations, with support for date arithmetic, parsing and formatting. It distinguishes wall clock dates and times from exact instants and supports multiple calendar systems. This implementation can install Temporal globally or expose it through local imports. It also provides a function-based API and entry points with either basic or extended calendar support.
Maintainer	Home Assistant Team <team+homeassistant@tracker.debian.org>
Changed By	Edward Betts <edward@4angle.com>
Sponsor	edward@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/homeassistant-team/js/node-temporal-polyfill.git (browse)
Closes	#1152934
Tracker	https://tracker.debian.org/pkg/node-temporal-polyfill
Uploaded	3 hours ago

New Package Report

.changes◂

Architecture	all source
Distribution	unstable
Date	Tue, 03 Nov 2026 11:50:00 +0000
Source	node-temporal-polyfill
Version	1.0.6-1
Changed-By	Edward Betts <edward@4angle.com>

Changelog◂

node-temporal-polyfill (1.0.6-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1152934)

.dsc◂

Priority	optional
Component	main
Package-List	node-temporal-polyfill deb javascript optional arch=all
Section	javascript

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: temporal-polyfill
Upstream-Contact: Adam Shaw
Source: https://github.com/fullcalendar/temporal-polyfill

Files: *
Copyright: 2026 Adam Shaw
License: Expat

Files: spec/*
Copyright: 2026 Adam Shaw
           Microsoft Corporation
License: Apache-2.0

Files: debian/*
Copyright: 2026 Edward Betts <edward@4angle.com>
License: Expat


License: Expat
 Permission is hereby granted, free of charge, to any person
 obtaining a copy of this software and associated documentation
 files (the "Software"), to deal in the Software without
 restriction, including without limitation the rights to use,
 copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the
 Software is furnished to do so, subject to the following
 conditions:
 .
 The above copyright notice and this permission notice shall be
 included in all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
 OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
 NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
 HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
 WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
 OTHER DEALINGS IN THE SOFTWARE.

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
     https://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the complete text of the Apache License, Version 2.0
 can be found in /usr/share/common-licenses/Apache-2.0.

DFSG Assistant LLM REVIEW 0 blocker, 1 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 hour ago.

Report◂

DFSG NEW review for node-temporal-polyfill version 1.0.6-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 0 blocker, 1 important, 1 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

Every licence in the tree is free and mutually compatible: MIT/Expat for polyfill/, utils/ and codemod/, Apache-2.0 for spec/ (derived from Microsoft TypeScript, with the Microsoft notice in spec/index.d.ts and spec/global.d.ts). debian/copyright is DEP-5, and its Files: * / spec/* / debian/* stanzas match the evidence. It is not complete, though: five files under polyfill/src/exoticCalendars/ say in their own headers that they are adapted from Adobe's @internationalized/date, and the copyright file attributes them only to Adam Shaw under Expat, naming neither the Adobe origin nor the Apache-2.0 attribution that derivation brings. Nothing non-free was found.

Packaging

Clean, conventional pkg-js packaging: debhelper compat 14, dh-sequence-nodejs-no-lerna with debian/nodejs/{main,additional_components,root_modules,polyfill/install,polyfill/build}, a readable rollup+typescript build in debian/build.mjs that avoids upstream's unshipped Terser fork, Standards-Version 4.7.4 against Policy 4.7.4.1, a WORKING autopkgtest test written as a node:test adapter for the vitest subset upstream uses, no patches, no maintainer scripts. All Build-Depends resolve in the archive (nodejs 24.22.2, node-typescript 6.0.3, rollup 3.30.0, node-rollup-plugin-dts 6.5.1, dh-sequence-single-binary from debhelper 14.5).

Issues

important licensing 1. debian/copyright omits the Adobe @internationalized/date origin of polyfill/src/exoticCalendars/* ◂

Files: debian/copyright:6-8, polyfill/src/exoticCalendars/hebrewCalendar.ts:4-6, polyfill/src/exoticCalendars/persianCalendar.ts:4-6, polyfill/src/exoticCalendars/indianCalendar.ts:6-8, polyfill/src/exoticCalendars/islamicCalendar.ts:14-16, polyfill/src/exoticCalendars/copticEthiopicCalendar.ts:5-7, polyfill/CHANGELOG.md:71
Basis: inferred from what was read, not seen directly
Evidence: hebrewCalendar.ts:4 // Adapted from Adobe's @internationalized/date Hebrew calendar implementation (same wording in persianCalendar.ts, indianCalendar.ts, islamicCalendar.ts, copticEthiopicCalendar.ts, each with a URL into adobe/react-spectrum); polyfill/CHANGELOG.md:71 calendar math is now algorithmic ... (credit to [@internationalized/date]); against debian/copyright Files: * / Copyright: 2026 Adam Shaw / License: Expat.
Problem: These five files are declared in their own headers to be adaptations of a third-party Apache-2.0 implementation, so they are not solely Adam Shaw's MIT code. Apache-2.0 section 4(c) requires the attribution notices of the source to be retained, and Policy 12.5 requires the copyright file to carry the package's copyright information. Upstream's polyfill/LICENSE (MIT) does not mention Adobe either, so the omission starts upstream, but Debian's copyright file is the one users get and it currently states a holder and a licence that do not cover those files. The licence itself is free, so this is an accuracy/attribution defect, not a DFSG violation.
Fix: Add a Files stanza for polyfill/src/exoticCalendars/* (at least the five adapted files) naming the Adobe copyright holder and License: Apache-2.0, reusing the existing standalone Apache-2.0 paragraph, and ask upstream to record the derivation in polyfill/LICENSE. The exact upstream holder string and licence should be taken from the react-spectrum @internationalized/date package, which could not be consulted offline.

minor packaging 2. uscan finds only upstream versions older than the packaged one ◂

Files: debian/watch
Basis: found by the review tooling's own checks
Evidence: upstream 0.3.2, packaged 1.0.6
Problem: The newest version uscan finds with debian/watch is older than the version in debian/changelog, so the watch file does not find the packaged release: it may look in the wrong place, or the versions may need mangling to compare.
Fix: Check where debian/watch looks and how it mangles versions.

Verified ◂

Inventoried the tree (529 files, excluding .pc/ and debian/) and checked every file against debian/copyright; every path is matched by Files: * (Expat), Files: spec/* (Apache-2.0) or Files: debian/* (Expat). No file is left without a licence.
Read every licence file: polyfill/LICENSE, utils/LICENSE, codemod/LICENSE (MIT, Copyright (c) 2026 Adam Shaw), spec/LICENSE (Apache-2.0 plus Portions of this software are derived from the TypeScript project ... Copyright (c) Microsoft Corporation). spec/index.d.ts:3-4 and spec/global.d.ts:3-4 carry Copyright (c) Microsoft Corporation. Licensed under the Apache License 2.0., which the Files: spec/* stanza covers; the copyright-holders pass of the prescan (every holder found is named in debian/copyright) matches this independently checked result.
No built, minified or binary assets in the tree: no *.min.js, *.map, PDF, image, font or archive files. polyfill/dist/ holds only .npmignore; its contents are generated at build time by debian/build.mjs from polyfill/src/ and utils/src/, both present, so the preferred form for modification is in the package.
Generated sources have their generators and inputs in the tree: misc/locale-textinfo/src/direction.ts, misc/locale-weekinfo/src/{firstDay,minimalDays}.ts and misc/datetimeformat-tokens/src/localeOrdinalsData.ts are outputs of the misc//scripts/compile-.js scripts, whose input misc/locale-data/locales/*.json is shipped.
misc/locale-data/locales/*.json are locale facts (week start day, ordinal suffixes, text direction) produced by misc/locale-data/scripts/localesScrape.js from the moment and FullCalendar submodules, both MIT (FullCalendar is Adam Shaw's). They are data, not code, and are not installed in the binary; the Files: * stanza is adequate for them.
The empty directories test262/, misc/export-size/, misc/terser/ and misc/locale-data/data/{moment,fullcalendar}/ are the unpopulated submodules listed in .gitmodules. Their absence only disables upstream's test262 lane and the private Terser fork for minification, neither used by the Debian build; debian/build.mjs says so in its header comment.
polyfill/src/internal/timeZoneConfig.ts:22-23 takes a 16-entry table of day counts from tc39/proposal-temporal and polyfill/src/internal/utils.ts:384-389 a two-line rounding formula credited to temporal-polyfill-lite: facts and a trivial expression, not substantial copied code requiring a copyright stanza.
Packaging read in full: debian/{control,rules,changelog,copyright,source/format,upstream/metadata,docs,examples,watch not reviewed}, debian/nodejs/{main,additional_components,root_modules,polyfill/build,polyfill/install}, debian/tests/pkg-js/*. Standards-Version 4.7.4 is current against Policy 4.7.4.1 (12.5 read for the copyright requirement). debhelper compat 14; overrides and hooks of dh_auto_test need no nocheck check at 13+. No debian/patches, no maintainer scripts, no debian/compat, Source format 3.0 (quilt).
The pkg-js install is consistent: main component polyfill installs its dist/* to /usr/share/nodejs/temporal-polyfill, the spec component is a root module installed as /usr/share/nodejs/temporal-spec (so the generated .d.ts files' temporal-spec imports resolve and ${nodejs:Provides} can advertise node-temporal-spec), and utils is compiled into the bundles rather than installed. Build-Depends checked against the archive: nodejs 24.22.2 satisfies (>= 24.0.0), node-typescript 6.0.3, node-rollup-plugin-dts 6.5.1, rollup 3.30.0, dh-sequence-single-binary provided by debhelper 14.5, dh-sequence-nodejs-no-lerna by dh-nodejs (Sequence/nodejs_no_lerna.pm present).
The test runner is real work, not a stub: debian/tests/pkg-js/api.mjs adapts the vitest subset the upstream tests use onto node:test with assertions backed by node:assert, api.test.mjs guards the adapter, and the test script runs every polyfill/src/**/*.test.ts plus requireEsm.test.ts, whose child process needs the dist symlink that the AUTOPKGTEST_TMP branch creates.
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

Whether the autopkgtest pkg-js environment has node-typescript installed: debian/tests/pkg-js/loader.mjs does createRequire(import.meta.url)('typescript'), and autopkgtest is not installed on the reviewing system, so the Depends of the generated test could not be read.
The exact copyright holder string and licence text of Adobe's @internationalized/date, which the issue above relies on, are not in the package and no copy is in the archive; only the derivation asserted by the package's own headers could be checked.

Proposed changes ◂

None.

Uploader's response to the LLM review

Waiting for the uploader's response until 2026-11-04 14:03 UTC, because the review found serious issues.

Back to Dashboard | View all reviews for this package