Review: node-uplot 1.6.32+ds2-1
New Package Report
.changes
| Version | 1.6.32+ds2-1 |
|---|---|
| Changed-By | Andrew Lee (李健秋) <ajqlee@debian.org> |
| Architecture | source all |
| Distribution | unstable |
| Date | Mon, 19 Oct 2026 10:30:58 +0200 |
| Source | node-uplot |
Changelog
node-uplot (1.6.32+ds2-1) unstable; urgency=medium . * debian/copyright: exclude demos and bench. * debian/copyright: add missing copyright for adopted source code. * debian/watch: repack +ds2. * New upstream version 1.6.32+ds2. * debian/clean: clean generated .css files.
.dsc
| Section | javascript |
|---|---|
| Priority | optional |
| Component | main |
| Package-List | node-uplot deb javascript optional arch=all |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ Upstream-Name: uplot Upstream-Contact: Leon Sorokin <leeoniya@gmail.com> Source: https://github.com/leeoniya/uPlot Files-Excluded: demo bench dist/*.js dist/*.css Files: * Copyright: 2022 Leon Sorokin <leeoniya@gmail.com> License: Expat Files: demos/lib/ASAP-optimized.js Copyright: 2014 Project Nayuki License: Expat Files: src/paths/monotoneCubic.js Copyright: Gion Kunz (Chartist.js) License: Expat Comment: adapted from the Chartist.js Files: src/paths/catmullRomCentrip.js Copyright: 2017 Nicholas Kyriakides & Unknown Authors License: Expat Comment: adapted from https://gist.github.com/nicholaswmin/c2661eb11cad5671d816 (MIT) Files: debian/* Copyright: 2026 Andrew Lee (李健秋) <ajqlee@debian.org> License: Expat License: Expat Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: . The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. . THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
DFSG Assistant LLM REVIEW 0 blocker, 1 important, 0 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 19 days ago.
Report
DFSG NEW review for node-uplot version 1.6.32+ds2-1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: No - Packaging is of good quality: Yes
- Issues: 0 blocker, 1 important, 0 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: 2 found
Licensing
The main library is entirely MIT (Expat) by Leon Sorokin and is correctly documented: src/ (including the adapted src/paths files, each with its own stanza), the root LICENSE/README, and the Project Nayuki ASAP-optimized.js demos/lib file all have accurate Files stanzas and the Expat text is included. The defect is confined to demos/: the Files-Excluded pattern demo does not match the actual demos/ directory, so the repack (intended, per the changelog, to 'exclude demos and bench') did not remove demos. The directory therefore ships minified vendored third-party code — demos/lib/placement.min.js (from tobyzerner's placement.js) and demos/lib/uDSV.iife.min.js (leeoniya/uDSV) — whose original sources are not in the tree and which are inaccurately attributed to Leon Sorokin by the Files: * catch-all (placement.min.js is not his code), so debian/copyright does not accurately describe every file in the source.
Packaging
Machine-readable DEP-5 copyright; debhelper compat 14 with dh --buildsystem nodejs; single arch:all binary, appropriate for a JS library; generated dist artifacts (dist/.js, dist/.min.css) are built from src/ at build time and cleaned via debian/clean; Standards-Version 4.7.4 matches current Policy; changelog sane with a bug closure; autopkgtest provided; Vcs/salsa metadata and DEP-3-style split all conventional for the JS team.
Issues
important licensing 1. demos/ not excluded despite Files-Excluded; contains minified vendored third-party code whose source is absent and whose copyright is misattributed ◂
- Files:
debian/copyright:7-11 (Files-Excluded),demos/lib/placement.min.js,demos/lib/uDSV.iife.min.js - Basis: checked, in the package or with a reference tool
- Evidence:
Files-Excluded:listsdemo(singular) but the directory isdemos/; placement.min.js begins// https://tobyzerner.github.io/placement.js/dist/index.js(a minified build of tobyzerner's MIT placement.js); uDSV.iife.min.js begins/*! https://github.com/leeoniya/uDSV (v0.5.3) */(minified). Neither file's original source is in the tree, and both fall under theFiles: */Copyright: 2022 Leon Sorokinstanza. - Problem: The changelog ('debian/copyright: exclude demos and bench') shows the intended repack exclusion did not happen because the
demopattern does not matchdemos. The two minified vendored files therefore remain in the DFSF-graded source: they lack their preferred form for modification (DFSG 3.1/3.2) and are inaccurately attributed to Leon Sorokin rather than their real holders (Toby Zerner for placement.min.js, and leeoniya/uDSV for uDSV), so debian/copyright does not accurately name the copyright of every file. - Fix: Fix the Files-Excluded pattern to
demos(andbench), so the repack actually removes the demos and the minified files along with it — matching the stated intent in the changelog — or, if demos are to be kept, add accurateFiles:/Copyright:/License:stanzas for these vendored files and include their non-minified sources.
Verified ◂
- debian/copyright is machine-readable DEP-5 (Format .../copyright-format/1.0/), with Files:* (Leon Sorokin, Expat), a standalone Expat paragraph, and specific stanzas for demos/lib/ASAP-optimized.js (Project Nayuki 2014, MIT), src/paths/monotoneCubic.js (Chartist.js), src/paths/catmullRomCentrip.js (Nicholas Kyriakides) and debian/*.
- Main library source: root LICENSE is MIT (c) 2022 Leon Sorokin; src/ and demos/.html show no other copyright/licence headers; rollup.config.js generates dist/.js with a Leon Sorokin MIT banner from src/. All consistent with the Files:* stanza.
- demos/lib/ASAP-optimized.js header: 'Copyright (c) 2014 Project Nayuki ... (MIT License)' — correctly matched by its own stanza.
- Built artifacts are not shipped in source: dist/ contains only uPlot.d.ts (typings); debian/clean removes dist/.js and dist/.min.css, which rollup (debian/nodejs/build) regenerates from src/.
- Packaging: debian/control (compat 14, dh-sequence-nodejs/single-binary, rollup, node-rollup-plugin-terser), single arch:all binary with no Depends (correct at compat 14), Standards-Version 4.7.4 matching current Policy, changelog with bug closure #1150751, autopkgtest pkg-js test, salsa Vcs fields, DEP-14 gbp.conf.
- Every holder the prescan's author check could find in the source is named in debian/copyright.
- uscan found the packaged version as the newest upstream release (upstream
1.6.32, packaged1.6.32+ds2).
Not confirmed ◂
- The dv/sgg/quatree/distr/rand/stats/randomWalk files in demos/lib carry no copyright headers but derive from assorted third-party sources (mljs/savitzky-golay-generalized, Stack Overflow, a blog post); whether their individual holders differ from Leon Sorokin is not declared by any visible notice. They are demo-only and not shipped in the binary.
Proposed changes ◂
None.
Uploader's response to the LLM review
The uploader hasn't responded yet, and is welcome to at any time. The 24-hour hold has ended, so the package is now open for review as usual.
Review Information
accepted — allocated to babelouest 18 days ago, started 18 days ago, completed 18 days ago.
Final Comment
Superseded by review of later version