Review: node-uplot 1.6.32+ds1-1

New Package Report

.changes◂

Date	Tue, 13 Oct 2026 10:30:04 +0200
Source	node-uplot
Version	1.6.32+ds1-1
Changed-By	Andrew Lee (李健秋) <ajqlee@debian.org>
Architecture	source all
Distribution	unstable

Changelog◂

node-uplot (1.6.32+ds1-1) unstable; urgency=medium
 .
   * Initial package. (Closes: #1150751)

.dsc◂

Priority	optional
Component	main
Package-List	node-uplot deb javascript optional arch=all
Section	javascript

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: uplot
Upstream-Contact: Leon Sorokin <leeoniya@gmail.com>
Source: https://github.com/leeoniya/uPlot
Files-Excluded:
 dist/*.js
 dist/*.css

Files: *
Copyright: 2022 Leon Sorokin <leeoniya@gmail.com>
License: Expat

Files: demos/lib/ASAP-optimized.js
Copyright: 2014 Project Nayuki
License: Expat

Files: debian/*
Copyright: 2026 Andrew Lee (李健秋) <ajqlee@debian.org>
License: Expat

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.

DFSG Assistant LLM REVIEW 1 blocker, 2 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 21 days ago.

Report◂

DFSG NEW review for node-uplot version 1.6.32+ds1-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 1 blocker, 2 important, 2 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: 2 found

Licensing

The library itself (src/, dist/uPlot.d.ts, LICENSE, debian/*) is Expat-licensed and described correctly, and the two minified files the scan found are demo assets, not installed code. But debian/copyright does not describe the whole source tree: demos/lib/placement.min.js is third-party code with its copyright and licence notice stripped and is attributed to Leon Sorokin, several other demos/lib files say they were ported from external sources but are not named, and the ASAP-optimized.js stanza credits only Project Nayuki although the file also contains code that Files: * attributes to Leon Sorokin. Two minified demo files also have no source in the package.

Packaging

Standard modern pkg-js packaging: debhelper compat 14 with dh-sequence-nodejs and dh-sequence-single-binary, no patches, a generated nodejs test, correct changelog and Vcs fields, Standards-Version 4.7.4 against Policy 4.7.4.1. The only definite packaging defect is the incomplete debian/clean; a suspected wrong build-dependency on the terser rollup plugin is under unconfirmed because it cannot be settled without a build.

Issues

blocker licensing 1. demos/lib/placement.min.js is unlicensed third-party code, attributed to the wrong copyright holder ◂

Files: demos/lib/placement.min.js:1, debian/copyright:9-11
Basis: checked, in the package or with a reference tool
Evidence: The file begins with only // https://tobyzerner.github.io/placement.js/dist/index.js and then minified code; the only stanza matching it is Files: * with Copyright: 2022 Leon Sorokin <leeoniya@gmail.com> and License: Expat. No Files stanza or licence notice mentions placement.js or Toby Zerner.
Problem: The file is code from the third-party placement.js project (the URL is its only provenance). Its copyright and permission notice were removed by minification, and debian/copyright asserts it is Leon Sorokin's Expat work. That is an inaccurate copyright file and leaves the file without any permission notice; under copyright-format 1.0 each file must be in a stanza with its actual holder and licence.
Fix: Add a Files: demos/lib/placement.min.js stanza naming Toby Zerner and the Expat text, and preferably ship the unminified upstream source; alternatively exclude demos/lib/*.min.js (or the whole demos/ and bench/ directories) with Files-Excluded and bump the repack version.

important licensing 2. Other third-party-derived demos/lib files and the ASAP stanza are not represented in debian/copyright ◂

Files: demos/lib/stats.js:1, demos/lib/randomWalk.js:1, demos/lib/sgg.js:1, demos/lib/ASAP-simple.js:1, demos/lib/ASAP-optimized.js:219-422, demos/data-smoothing.html:21-22, debian/copyright:13-15
Basis: checked, in the package or with a reference tool
Evidence: // ported from https://stackoverflow.com/questions/14683467/... (stats.js), // https://stackoverflow.com/a/22080644 (randomWalk.js), // https://github.com/mljs/savitzky-golay-generalized (sgg.js). ASAP-simple.js has no notice at all; its smooth/SMA/Metrics code is the same code as ASAP-optimized.js:239+, while the stanza for that file is Copyright: 2014 Project Nayuki and the demo cites https://github.com/stanford-futuredata/ASAP.
Problem: The copyright file names only Leon Sorokin (plus Nayuki for ASAP-optimized.js). These files themselves state that they were ported or adapted from external sources, so the Copyright field is incomplete, and for ASAP-optimized.js it credits only Nayuki for a file that also contains the ASAP code attributed to Leon elsewhere. The StackOverflow-derived files also cannot be stated to be Expat-only without knowing the source licence (StackOverflow contributions are normally CC BY-SA, which is not compatible with relicensing the file under Expat alone).
Fix: Determine each file's provenance and add a Files stanza with the actual holder(s) and licence (or rewrite/remove the derived code), and split ASAP-optimized.js's stanza so both the Nayuki FFT and the ASAP code are credited. Excluding demos/ from the source via Files-Excluded would also remove the problem.

important licensing 3. Minified demo files are shipped without their source ◂

Files: demos/lib/placement.min.js, demos/lib/uDSV.iife.min.js
Basis: checked, in the package or with a reference tool
Evidence: Both are single-line minified bundles; placement.min.js has only a source URL and uDSV.iife.min.js only /*! https://github.com/leeoniya/uDSV (v0.5.3) */. Neither the placement.js source nor the uDSV source is anywhere in the tree, and Files-Excluded names only dist/.js and dist/.css.
Problem: DFSG 2 requires the preferred form for modification. A minified file whose unminified source is absent from the source package is not distributable as free software, even when it is demo-only code and not installed in the binary.
Fix: Ship the unminified sources (placement.js and uDSV) in the package, or exclude the minified files (or demos/ entirely) with Files-Excluded.

minor licensing 4. Adapted MIT code in src/paths lacks its upstream copyright holders in debian/copyright ◂

Files: src/paths/monotoneCubic.js:7-8, src/paths/catmullRomCentrip.js:8, debian/copyright:9-11
Basis: checked, in the package or with a reference tool
Evidence: // Monotone Cubic Spline interpolation, adapted from the Chartist.js implementation: (monotoneCubic.js) and // adapted from https://gist.github.com/nicholaswmin/c2661eb11cad5671d816 (MIT) (catmullRomCentrip.js); Files: * names only Leon Sorokin.
Problem: Both files are installed in the binary and are adaptations of third-party MIT code (Chartist.js by Gion Kunz; the gist by nicholaswmin). The licence is compatible, but the Copyright field omits those holders, so debian/copyright is incomplete for files that are actually shipped.
Fix: Add Files stanzas (or extend the copyright holders) for these two files naming the upstream authors, with the Expat licence already included.

minor packaging 5. debian/clean does not remove the generated dist/uPlot.min.css ◂

Files: debian/clean:1, rollup.config.js:16-17
Basis: checked, in the package or with a reference tool
Evidence: debian/clean contains only dist/*.js, while rollup.config.js writes ./dist/uPlot.min.css before the rollup outputs (and the other generated files are dist/*.js).
Problem: After a build, debian/rules clean leaves dist/uPlot.min.css in the source tree; a source build made from that tree would then include a generated CSS file in the debian tarball, which is not in the orig tarball.
Fix: Change debian/clean to dist/*.js and dist/*.css (or dist/*.min.css).

Verified ◂

Read debian/copyright in full (DEP-5), debian/control, rules, changelog, gbp.conf, clean, source/format, nodejs/build, nodejs/extlinks, tests/pkg-js/test and upstream/metadata; there is no debian/patches.
Inventoried the 149-file tree (excluding .pc/ and debian/): src/ (the input of the built bundles), demos/, bench/, docs/, img/, dist/uPlot.d.ts, LICENSE, README.md, package.json and rollup.config.js.
The orig tarball contains only dist/uPlot.d.ts under dist/, so the repack matches Files-Excluded (dist/.js, dist/.css); rollup.config.js regenerates dist/uPlot.esm.js, .cjs.js, .iife.js, .iife.min.js and .min.css from src/uPlot.js and src/uPlot.css.
The two files the scan lists as minified are demos/lib/placement.min.js and demos/lib/uDSV.iife.min.js; both are discussed above and neither is installed: package.json#files is package.json, README.md, LICENSE, dist, and dh-sequence-nodejs installs only that list (checked in the nodejs debhelper buildsystem).
The prescan author check found all three declared authors; a tree-wide grep for Copyright/(C)/©/SPDX-License-Identifier/licence notices found nothing beyond what debian/copyright lists, and the only LICENSE/COPYING/NOTICE file is the root LICENSE (Expat).
uPlot.png, perf.png and img/.png are README/docs screenshots; demos/data/ and bench/data.json are demo/benchmark data; all are covered by Files: * and none is installed.
Standards-Version 4.7.4 against Policy 4.7.4.1 on the reviewing system: first two components match, so it is current enough; Vcs-Git/Vcs-Browser, Homepage, arch:all single binary and the changelog (unstable, +ds1 repack version, ITP closure) are consistent.
Build-Depends names rollup and node-rollup-plugin-terser; both exist in the archive (apt-cache show). debian/nodejs/build runs rollup -c --bundleConfigAsCjs and debian/tests/pkg-js/test exercises the built dist/uPlot.cjs.js; Testsuite: autopkgtest-pkg-nodejs is declared.
debian/* has its own Files stanza; there are no maintainer scripts, no install/links/docs files and no patch series.
uscan found the packaged version as the newest upstream release (upstream 1.6.32, packaged 1.6.32+ds1).

Not confirmed ◂

Suspected build failure: rollup.config.js imports @rollup/plugin-terser and debian/nodejs/extlinks names it, but Build-Depends lists node-rollup-plugin-terser, which in the archive is version 7.0.2, the old unscoped rollup-plugin-terser (apt-cache show: Provides node-ascjs, node-smob); pkg-js-tools resolves extlinks with nodepath and errors when the scoped module is absent. package.json also declares rollup ^4.35.0 while the archive has 3.30.0. A build would show whether the scoped plugin is available from NEW or another package; if not, the build fails at configure and rollup.
The provenance and licensing of the demo data (demos/data/.csv, demos/data/.json) and bench/data.json are not documented in the package; they appear to be test/demo data and are not installed, so I did not treat them as a finding.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader hasn't responded yet, and is welcome to at any time. The 24-hour hold has ended, so the package is now open for review as usual.

Review Information

accepted — allocated to babelouest 18 days ago, started 18 days ago, completed 18 days ago.

Final Comment

Superseded by review of later version

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
1.6.32+ds3-1	7ea05677…	2026-10-21 01:11	2026-10-21 01:12	babelouest	accepted	VIEW
1.6.32+ds2-1	807cc1df…	2026-10-21 01:12	2026-10-21 01:12	babelouest	accepted	VIEW

Back to Dashboard | View all reviews for this package