DFSG NEW Queue

DFSG, Licensing & New Packages Team

python-neo4j 6.4.1-1

Package Information

DescriptionNeo4j Bolt driver for Python

Official Python driver for connecting applications to Neo4j databases. Offers synchronous and asynchronous APIs for connecting to a database, running Cypher queries, and managing sessions and transactions. Also supports routed connections, authentication, and Neo4j data types, including temporal, spatial, graph, and vector values.

Optional integrations provide support for NumPy, pandas, and PyArrow values.

The driver also offers a preview HTTP Query API alongside its standard Bolt protocol support.

MaintainerDebian Python Team <team+python@tracker.debian.org>
Changed ByLester Guerzon <lester@guerzon.net>
Sponsorjcfp@debian.org
Distributionunstable
Architectureall
VCSgit: https://salsa.debian.org/python-team/packages/python-neo4j.git (browse)
Closes#1151494
Trackerhttps://tracker.debian.org/pkg/python-neo4j
Uploaded1 hour ago

New Package Report

.changes◂
Sourcepython-neo4j
Version6.4.1-1
Changed-ByLester Guerzon <lester@guerzon.net>
Architecturesource all
Distributionunstable
DateSun, 15 Nov 2026 16:35:22 +0000
Changelog◂
python-neo4j (6.4.1-1) unstable; urgency=medium
 .
   * Initial release 6.4.1 (Closes: #1151494)
.dsc◂
Sectiondoc
Priorityoptional
Componentmain
Package-Listpython-neo4j-doc deb doc optional arch=all
python3-neo4j deb python optional arch=all
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: neo4j-python-driver
Source: https://github.com/neo4j/neo4j-python-driver

Files: *
Copyright: Neo4j Sweden AB
License: Apache-2.0

Files: src/neo4j/_async_compat/concurrency.py
Copyright:
 Neo4j Sweden AB
 2001-2022 Python Software Foundation
License: Apache-2.0 and PSF-2.0
Comment: The PSF-2.0 terms apply only to the AsyncCondition class,
 copied and modified from Python 3.11's asyncio package.
 The rest of this file is under Apache-2.0.

Files: src/neo4j/_async_compat/shims/_wait_for.py
Copyright:
 Neo4j Sweden AB
 2001-2022 Python Software Foundation
License: Apache-2.0 and PSF-2.0
Comment: The PSF-2.0 terms apply only to the code copied and modified
 from Python 3.10's asyncio package in the conditional block below the
 "patch asyncio.wait_for" heading. The rest of this file is under
 Apache-2.0.

Files: tests/conftest.py
Copyright:
 Neo4j Sweden AB
 2001-2022 Python Software Foundation
License: Apache-2.0 and PSF-2.0
Comment: The PSF-2.0 terms apply only to _cancel_all_tasks, copied and
 modified from Python 3.13's asyncio package. The rest of this file is
 under Apache-2.0.

Files: debian/*
Copyright: 2026 Lester Guerzon <lester@guerzon.net>
License: Expat

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

License: Apache-2.0
 Debian systems provide the Apache 2.0 license in
 /usr/share/common-licenses/Apache-2.0

License: PSF-2.0
 PYTHON SOFTWARE FOUNDATION LICENSE VERSION 2
 .
 1. This LICENSE AGREEMENT is between the Python Software Foundation
 ("PSF"), and the Individual or Organization ("Licensee") accessing
 and otherwise using this software ("Python") in source or binary form
 and its associated documentation.
 .
 2. Subject to the terms and conditions of this License Agreement, PSF
 hereby grants Licensee a nonexclusive, royalty-free, world-wide
 license to reproduce, analyze, test, perform and/or display publicly,
 prepare derivative works, distribute, and otherwise use Python alone
 or in any derivative version, provided, however, that PSF's License
 Agreement and PSF's notice of copyright, i.e., "Copyright (c) 2001,
 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012,
 2013, 2014, 2015, 2016, 2017, 2018, 2019 Python Software Foundation;
 All Rights Reserved" are retained in Python alone or in any
 derivative version prepared by Licensee.
 .
 3. In the event Licensee prepares a derivative work that is based on
 or incorporates Python or any part thereof, and wants to make the
 derivative work available to others as provided herein, then Licensee
 hereby agrees to include in any such work a brief summary of the
 changes made to Python.
 .
 4. PSF is making Python available to Licensee on an "AS IS" basis.
 PSF MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED.  BY
 WAY OF EXAMPLE, BUT NOT LIMITATION, PSF MAKES NO AND DISCLAIMS ANY
 REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS FOR ANY
 PARTICULAR PURPOSE OR THAT THE USE OF PYTHON WILL NOT INFRINGE ANY
 THIRD PARTY RIGHTS.
 .
 5. PSF SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF PYTHON
 FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS AS A
 RESULT OF MODIFYING, DISTRIBUTING, OR OTHERWISE USING PYTHON, OR ANY
 DERIVATIVE THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF.
 .
 6. This License Agreement will automatically terminate upon a
 material breach of its terms and conditions.
 .
 7. Nothing in this License Agreement shall be deemed to create any
 relationship of agency, partnership, or joint venture between PSF and
 Licensee.  This License Agreement does not grant permission to use
 PSF trademarks or trade name in a trademark sense to endorse or
 promote products or services of Licensee, or any third party.
 .
 8. By copying, installing or otherwise using Python, Licensee agrees
 to be bound by the terms and conditions of this License Agreement.

DFSG Assistant LLM REVIEW 2 blocker, 0 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 0 hours ago.

Report◂

DFSG NEW review for python-neo4j version 6.4.1-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: No
  • Packaging is of good quality: No
  • Issues: 2 blocker, 0 important, 2 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable
  • Scan before the review: 1 found

Licensing

The driver's own code is Apache-2.0 with three PSF-2.0 excerpts, both free and mutually compatible, and debian/copyright handles those correctly. But it does not describe the vendored documentation-theme assets: five webfont files have no licence or copyright notice anywhere and are attributed to Neo4j under Apache-2.0, and the minified site.css embeds MIT-licensed Font Awesome 4.7.0 CSS and a highlight.js theme whose holders are named nowhere. The source package is distributed with those statements wrong, so debian/copyright is not accurate.

Packaging

The packaging is modern and largely correct: debhelper compat 14 with dh-sequence-python3 and pybuild-plugin-pyproject, a correct Build-Depends (test-only deps marked <!nocheck>, sphinx not), autopkgtest-pkg-pybuild, DEP-3 patches, doc-base, Salsa CI and a current Standards-Version. One real bug: the upstream release tree carries the unsubstituted development version, so the built module metadata and neo4j.version say 6.4.dev0 while the package is 6.4.1.

Issues

blocker licensing 1. The five Nunito Sans woff2 files have no licence or copyright notice and are wrongly declared Apache-2.0 / Neo4j Sweden AB ◂
  • Files: docs/source/themes/neo4j/static/fonts/nunito-sans-cyrillic-ext.woff2, docs/source/themes/neo4j/static/fonts/nunito-sans-cyrillic.woff2, docs/source/themes/neo4j/static/fonts/nunito-sans-latin-ext.woff2, docs/source/themes/neo4j/static/fonts/nunito-sans-latin.woff2, docs/source/themes/neo4j/static/fonts/nunito-sans-vietnamese.woff2, docs/source/themes/neo4j/static/css/nunito-sans.css, debian/copyright

  • Basis: inferred from what was read, not seen directly

  • Evidence:

    nunito-sans.css: src: url(../fonts/nunito-sans-latin.woff2) format('woff2'); there is no LICENSE/NOTICE/COPYING anywhere under docs/. debian/copyright has only:

    Files: *
    Copyright: Neo4j Sweden AB
    License: Apache-2.0
    
  • Problem: These are binary third-party webfonts (the Nunito Sans typeface used by the theme) shipped in the source package with no grant or attribution of their own; the only statement covering them, Files: *, claims Neo4j Sweden AB and Apache-2.0, which cannot be right for Google's Nunito Sans and is not a licence under which the package can distribute them. A file with no licence, or with a wrong licence stated for it, is a DFSG problem wherever it is, because the source package is distributed too (Policy 2.3 requires the distribution licence to be present). The theme is unused after use-local-theme.patch and nothing here is installed into a binary, but that does not make the source package's licensing statement correct.

  • Fix: Identify the fonts (Nunito Sans, SIL OFL 1.1) and add a Files: docs/source/themes/neo4j/static/fonts/* stanza naming the typeface's authors/Google and Neo4j, with the full OFL-1.1 text; or drop the unused theme from the source package (Files-Excluded/repack), in which case no stanza is needed.

blocker licensing 2. site.css is declared Apache-2.0 but embeds MIT-licensed Font Awesome 4.7.0 CSS and a highlight.js theme, whose holders debian/copyright does not name ◂
  • Files: docs/source/themes/neo4j/static/css/site.css:1, docs/source/themes/neo4j/static/css/site.css:4, docs/source/themes/neo4j/static/css/site.css:6-7, debian/copyright

  • Basis: checked, in the package or with a reference tool

  • Evidence:

    /* https://neo4j.com/docs/assets/css/site.css */
    /*! Adapted from the GitHub style by Vasily Polovnyov <vast@whiteants.net> */
    /*!
     *  Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome
     *  License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
     */
    
  • Problem: The prescan's minified file is a minified copy of Neo4j's docs site CSS that incorporates a highlight.js colour theme (MIT, Vasily Polovnyov) and the whole Font Awesome 4.7.0 stylesheet (MIT, Dave Gandy), plus further third-party styling. debian/copyright covers it only with Files: * / Copyright: Neo4j Sweden AB / License: Apache-2.0: the two MIT parts and their holders are not described, so the License field of the stanza that matches the file is wrong (copyright-format 1.0 section 6.7). MIT requires the copyright and permission notice to accompany copies; only the attribution line is in the file and the licence text is not associated with it. No unminified source for the file is in the package either. Not installed in any binary (theme disabled, only _build/html/ is shipped), but the source package is distributed with the inaccurate statement.

  • Fix: Add a stanza for docs/source/themes/neo4j/static/css/site.css (e.g. Copyright: Dave Gandy, Vasily Polovnyov, Neo4j Sweden AB, License: Apache-2.0 and Expat, with a Comment identifying the Font Awesome and highlight.js portions), or drop the unused theme from the source package.

minor licensing 3. debian/copyright does not name JetBrains as holder of the teamcity-messages code in tests/_teamcity.py ◂
  • Files: tests/_teamcity.py:96-97, debian/copyright

  • Basis: checked, in the package or with a reference tool

  • Evidence:

    # function taken from teamcity-messages package
    # Copyright JetBrains, licensed under Apache 2.0
    

    debian/copyright has only Files: * / Copyright: Neo4j Sweden AB for the file.

  • Problem: A function copied from JetBrains' teamcity-messages is marked Apache-2.0 (compatible with the file's own licence) but its holder is not in debian/copyright. Policy 2.3 does not require it here: tests are not installed into any binary package (pybuild installs only the neo4j module), and the notice is present as plain text in the file, so conditions 2 and 3 of Policy 2.3 fail. A complete DEP-5 file should still name it.

  • Fix: Add a Files: tests/_teamcity.py stanza with Copyright: JetBrains and License: Apache-2.0.

minor packaging 4. Installed Python metadata and neo4j.version report 6.4.dev0 instead of 6.4.1 ◂
  • Files: src/neo4j/_meta.py:32, pyproject.toml:186-187, debian/rules:10-11, bin/dist-functions
  • Basis: checked, in the package or with a reference tool
  • Evidence: src/neo4j/_meta.py:32: version = "6.4.dev0"; pyproject.toml:186-187: [tool.setuptools.dynamic] / version = {attr = "neo4j._meta.version"}. Upstream substitutes the release version only in bin/dist-functions (set_version does sed -i 's/^version = .*/version = "$1"/g' and reverts it afterwards); neither debian/rules nor pybuild does this.
  • Problem: The orig tarball is the GitHub tag archive (neo4j-python-driver-6.4.1/), which contains the unreleased 6.4.dev0 string; the release sdist produced by bin/make-dist would have had it replaced. Pybuild runs python3 -m build --no-isolation with the setuptools backend, which reads the version from neo4j._meta.version, so the wheel and installed dist-info are neo4j-6.4.dev0 and neo4j.__version__ is 6.4.dev0 although the Debian package is 6.4.1. The same value feeds docs/source/conf.py (release), so the shipped documentation also calls itself 6.4.dev0. importlib.metadata.version("neo4j") is then a prerelease older than 6.4, which misleads tools and users comparing versions.
  • Fix: Add a patch setting version = "6.4.1" in src/neo4j/_meta.py (and forward it upstream), or build from upstream's released sdist where the version is already substituted, so the built module's metadata and __version__ match the package version.
Verified ◂
  • Read every file in debian/ (control, rules, changelog, copyright, source/format, gbp.conf, salsa-ci.yml, upstream/metadata, the .docs and doc-base files) and all three patches; no patch creates a file.
  • Walked the upstream tree directory by directory (src, tests, docs, testkit, testkitbackend, benchkit, benchmarks, bin, .github, top-level files, 544 files per the prescan); every program file carries the Apache-2.0 Neo4j header and is covered by Files: *.
  • The PSF-2.0 excerpts in src/neo4j/_async_compat/concurrency.py, src/neo4j/_async_compat/shims/_wait_for.py and tests/conftest.py retain their PSF notices and are covered by their stanzas; no other CPython-derived code was found.
  • No non-free wording (non-commercial, no-modification, field-of-use, research-only and the like) anywhere in the tree.
  • The prescan's minified file, docs/source/themes/neo4j/static/css/site.css, is the third-party-derived CSS bundle reported above; it is not generated from neo4j.css_t.
  • docs/source/themes/ is not used by the build: use-local-theme.patch sets html_theme = "alabaster", and python-neo4j-doc.docs installs only _build/html/, so the fonts and site.css reach no binary package.
  • The only other binary files are docs/source/_images/core_type_mappings.png (its SVG source is beside it) and docs/source/themes/neo4j/static/menu.svg.
  • pytz is genuinely used at runtime (hence Depends: python3-pytz); aiohttp/urllib3 are reached only through the network package's lazy __getattr__, so Suggests is right; typing_extensions imports are TYPE_CHECKING- or version-guarded.
  • Build dependencies suffice for the actual build: pybuild-plugin-pyproject pulls python3-build and python3-installer, python3-sphinx depends on python3-alabaster, the sphinx run in execute_after_dh_auto_build is outside the test step (so python3-sphinx is correctly not <!nocheck>), and pybuild copies tests/ into its build dir before pytest tests/unit.
  • doc-base's Files: ...html/*.html wildcard is normal: the same form is used by debian-policy, the Debian FAQ and others in /usr/share/doc-base.
  • Packaging checks: Standards-Version 4.7.4 is current against Policy 4.7.4.1, the changelog is an initial release to unstable closing #1151494, debhelper compat 14 means missing relationship substvars in debian/control are not a fault, and both binary packages are Architecture: all with Multi-Arch: foreign as other arch:all Python modules are.
  • uscan found the packaged version as the newest upstream release (upstream 6.4.1, packaged 6.4.1).
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).
Not confirmed ◂
  • The woff2 files were not opened: that they are Google's Nunito Sans under SIL OFL 1.1 is inferred from the file names and from the Google-Fonts-style nunito-sans.css, not read from the binaries.
  • Whether python3-pyarrow exists on loong64 and riscv64, where Build-Depends lists it; the package lists available here cover only the archive's main architectures.
  • The build was not run (as instructed), so the 6.4.dev0 wheel metadata was established from pyproject.toml, src/neo4j/_meta.py, bin/dist-functions and pybuild's build path, not from a built wheel.
  • Why the model asked for what a review has no use for. During this review it asked once for something outside the package and the reviewing system (another file of the sandbox, or a URL), or was given part of the review tooling's own configuration, and that was refused or withheld. A model does this when something it has read tells it to, so look in the package for text addressed to a reviewing program, and treat this report with suspicion. Refused: read: "xd://read/sources" is not a file of the package or of the reviewing system.
Proposed changes ◂

None.

Uploader's response to the LLM review

Waiting for the uploader's response until , because the review found serious issues.

Back to Dashboard | View all reviews for this package