python-neo4j 6.4.1-1
Package Information
| Description | Neo4j Bolt driver for Python Official Python driver for connecting applications to Neo4j databases. Offers synchronous and asynchronous APIs for connecting to a database, running Cypher queries, and managing sessions and transactions. Also supports routed connections, authentication, and Neo4j data types, including temporal, spatial, graph, and vector values. Optional integrations provide support for NumPy, pandas, and PyArrow values. The driver also offers a preview HTTP Query API alongside its standard Bolt protocol support. |
|---|---|
| Maintainer | Debian Python Team <team+python@tracker.debian.org> |
| Changed By | Lester Guerzon <lester@guerzon.net> |
| Sponsor | jcfp@debian.org |
| Distribution | unstable |
| Architecture | all |
| VCS | git: https://salsa.debian.org/python-team/packages/python-neo4j.git (browse) |
| Closes | #1151494 |
| Tracker | https://tracker.debian.org/pkg/python-neo4j |
| Uploaded | 1 hour ago |
New Package Report
.changes
| Source | python-neo4j |
|---|---|
| Version | 6.4.1-1 |
| Changed-By | Lester Guerzon <lester@guerzon.net> |
| Architecture | source all |
| Distribution | unstable |
| Date | Sun, 15 Nov 2026 16:35:22 +0000 |
Changelog
python-neo4j (6.4.1-1) unstable; urgency=medium . * Initial release 6.4.1 (Closes: #1151494)
.dsc
| Section | doc |
|---|---|
| Priority | optional |
| Component | main |
| Package-List | python-neo4j-doc deb doc optional arch=all python3-neo4j deb python optional arch=all |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: neo4j-python-driver
Source: https://github.com/neo4j/neo4j-python-driver
Files: *
Copyright: Neo4j Sweden AB
License: Apache-2.0
Files: src/neo4j/_async_compat/concurrency.py
Copyright:
Neo4j Sweden AB
2001-2022 Python Software Foundation
License: Apache-2.0 and PSF-2.0
Comment: The PSF-2.0 terms apply only to the AsyncCondition class,
copied and modified from Python 3.11's asyncio package.
The rest of this file is under Apache-2.0.
Files: src/neo4j/_async_compat/shims/_wait_for.py
Copyright:
Neo4j Sweden AB
2001-2022 Python Software Foundation
License: Apache-2.0 and PSF-2.0
Comment: The PSF-2.0 terms apply only to the code copied and modified
from Python 3.10's asyncio package in the conditional block below the
"patch asyncio.wait_for" heading. The rest of this file is under
Apache-2.0.
Files: tests/conftest.py
Copyright:
Neo4j Sweden AB
2001-2022 Python Software Foundation
License: Apache-2.0 and PSF-2.0
Comment: The PSF-2.0 terms apply only to _cancel_all_tasks, copied and
modified from Python 3.13's asyncio package. The rest of this file is
under Apache-2.0.
Files: debian/*
Copyright: 2026 Lester Guerzon <lester@guerzon.net>
License: Expat
License: Expat
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
.
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
License: Apache-2.0
Debian systems provide the Apache 2.0 license in
/usr/share/common-licenses/Apache-2.0
License: PSF-2.0
PYTHON SOFTWARE FOUNDATION LICENSE VERSION 2
.
1. This LICENSE AGREEMENT is between the Python Software Foundation
("PSF"), and the Individual or Organization ("Licensee") accessing
and otherwise using this software ("Python") in source or binary form
and its associated documentation.
.
2. Subject to the terms and conditions of this License Agreement, PSF
hereby grants Licensee a nonexclusive, royalty-free, world-wide
license to reproduce, analyze, test, perform and/or display publicly,
prepare derivative works, distribute, and otherwise use Python alone
or in any derivative version, provided, however, that PSF's License
Agreement and PSF's notice of copyright, i.e., "Copyright (c) 2001,
2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012,
2013, 2014, 2015, 2016, 2017, 2018, 2019 Python Software Foundation;
All Rights Reserved" are retained in Python alone or in any
derivative version prepared by Licensee.
.
3. In the event Licensee prepares a derivative work that is based on
or incorporates Python or any part thereof, and wants to make the
derivative work available to others as provided herein, then Licensee
hereby agrees to include in any such work a brief summary of the
changes made to Python.
.
4. PSF is making Python available to Licensee on an "AS IS" basis.
PSF MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED. BY
WAY OF EXAMPLE, BUT NOT LIMITATION, PSF MAKES NO AND DISCLAIMS ANY
REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS FOR ANY
PARTICULAR PURPOSE OR THAT THE USE OF PYTHON WILL NOT INFRINGE ANY
THIRD PARTY RIGHTS.
.
5. PSF SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF PYTHON
FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS AS A
RESULT OF MODIFYING, DISTRIBUTING, OR OTHERWISE USING PYTHON, OR ANY
DERIVATIVE THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF.
.
6. This License Agreement will automatically terminate upon a
material breach of its terms and conditions.
.
7. Nothing in this License Agreement shall be deemed to create any
relationship of agency, partnership, or joint venture between PSF and
Licensee. This License Agreement does not grant permission to use
PSF trademarks or trade name in a trademark sense to endorse or
promote products or services of Licensee, or any third party.
.
8. By copying, installing or otherwise using Python, Licensee agrees
to be bound by the terms and conditions of this License Agreement.
DFSG Assistant LLM REVIEW 2 blocker, 0 important, 2 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 0 hours ago.
Report
DFSG NEW review for python-neo4j version 6.4.1-1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: No - Packaging is of good quality: No
- Issues: 2 blocker, 0 important, 2 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: 1 found
Licensing
The driver's own code is Apache-2.0 with three PSF-2.0 excerpts, both free and mutually compatible, and debian/copyright handles those correctly. But it does not describe the vendored documentation-theme assets: five webfont files have no licence or copyright notice anywhere and are attributed to Neo4j under Apache-2.0, and the minified site.css embeds MIT-licensed Font Awesome 4.7.0 CSS and a highlight.js theme whose holders are named nowhere. The source package is distributed with those statements wrong, so debian/copyright is not accurate.
Packaging
The packaging is modern and largely correct: debhelper compat 14 with dh-sequence-python3 and pybuild-plugin-pyproject, a correct Build-Depends (test-only deps marked <!nocheck>, sphinx not), autopkgtest-pkg-pybuild, DEP-3 patches, doc-base, Salsa CI and a current Standards-Version. One real bug: the upstream release tree carries the unsubstituted development version, so the built module metadata and neo4j.version say 6.4.dev0 while the package is 6.4.1.
Issues
blocker licensing 1. The five Nunito Sans woff2 files have no licence or copyright notice and are wrongly declared Apache-2.0 / Neo4j Sweden AB ◂
-
Files:
docs/source/themes/neo4j/static/fonts/nunito-sans-cyrillic-ext.woff2,docs/source/themes/neo4j/static/fonts/nunito-sans-cyrillic.woff2,docs/source/themes/neo4j/static/fonts/nunito-sans-latin-ext.woff2,docs/source/themes/neo4j/static/fonts/nunito-sans-latin.woff2,docs/source/themes/neo4j/static/fonts/nunito-sans-vietnamese.woff2,docs/source/themes/neo4j/static/css/nunito-sans.css,debian/copyright -
Basis: inferred from what was read, not seen directly
-
Evidence:
nunito-sans.css:src: url(../fonts/nunito-sans-latin.woff2) format('woff2'); there is no LICENSE/NOTICE/COPYING anywhere under docs/.debian/copyrighthas only:Files: * Copyright: Neo4j Sweden AB License: Apache-2.0 -
Problem: These are binary third-party webfonts (the Nunito Sans typeface used by the theme) shipped in the source package with no grant or attribution of their own; the only statement covering them,
Files: *, claims Neo4j Sweden AB and Apache-2.0, which cannot be right for Google's Nunito Sans and is not a licence under which the package can distribute them. A file with no licence, or with a wrong licence stated for it, is a DFSG problem wherever it is, because the source package is distributed too (Policy 2.3 requires the distribution licence to be present). The theme is unused after use-local-theme.patch and nothing here is installed into a binary, but that does not make the source package's licensing statement correct. -
Fix: Identify the fonts (Nunito Sans, SIL OFL 1.1) and add a
Files: docs/source/themes/neo4j/static/fonts/*stanza naming the typeface's authors/Google and Neo4j, with the full OFL-1.1 text; or drop the unused theme from the source package (Files-Excluded/repack), in which case no stanza is needed.
blocker licensing 2. site.css is declared Apache-2.0 but embeds MIT-licensed Font Awesome 4.7.0 CSS and a highlight.js theme, whose holders debian/copyright does not name ◂
-
Files:
docs/source/themes/neo4j/static/css/site.css:1,docs/source/themes/neo4j/static/css/site.css:4,docs/source/themes/neo4j/static/css/site.css:6-7,debian/copyright -
Basis: checked, in the package or with a reference tool
-
Evidence:
/* https://neo4j.com/docs/assets/css/site.css */ /*! Adapted from the GitHub style by Vasily Polovnyov <vast@whiteants.net> */ /*! * Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License) */ -
Problem: The prescan's minified file is a minified copy of Neo4j's docs site CSS that incorporates a highlight.js colour theme (MIT, Vasily Polovnyov) and the whole Font Awesome 4.7.0 stylesheet (MIT, Dave Gandy), plus further third-party styling.
debian/copyrightcovers it only withFiles: */Copyright: Neo4j Sweden AB/License: Apache-2.0: the two MIT parts and their holders are not described, so theLicensefield of the stanza that matches the file is wrong (copyright-format 1.0 section 6.7). MIT requires the copyright and permission notice to accompany copies; only the attribution line is in the file and the licence text is not associated with it. No unminified source for the file is in the package either. Not installed in any binary (theme disabled, only_build/html/is shipped), but the source package is distributed with the inaccurate statement. -
Fix: Add a stanza for
docs/source/themes/neo4j/static/css/site.css(e.g.Copyright: Dave Gandy, Vasily Polovnyov, Neo4j Sweden AB,License: Apache-2.0 and Expat, with aCommentidentifying the Font Awesome and highlight.js portions), or drop the unused theme from the source package.
minor licensing 3. debian/copyright does not name JetBrains as holder of the teamcity-messages code in tests/_teamcity.py ◂
-
Files:
tests/_teamcity.py:96-97,debian/copyright -
Basis: checked, in the package or with a reference tool
-
Evidence:
# function taken from teamcity-messages package # Copyright JetBrains, licensed under Apache 2.0debian/copyrighthas onlyFiles: * / Copyright: Neo4j Sweden ABfor the file. -
Problem: A function copied from JetBrains' teamcity-messages is marked Apache-2.0 (compatible with the file's own licence) but its holder is not in
debian/copyright. Policy 2.3 does not require it here: tests are not installed into any binary package (pybuild installs only the neo4j module), and the notice is present as plain text in the file, so conditions 2 and 3 of Policy 2.3 fail. A complete DEP-5 file should still name it. -
Fix: Add a
Files: tests/_teamcity.pystanza withCopyright: JetBrainsandLicense: Apache-2.0.
minor packaging 4. Installed Python metadata and neo4j.version report 6.4.dev0 instead of 6.4.1 ◂
- Files:
src/neo4j/_meta.py:32,pyproject.toml:186-187,debian/rules:10-11,bin/dist-functions - Basis: checked, in the package or with a reference tool
- Evidence:
src/neo4j/_meta.py:32:version = "6.4.dev0";pyproject.toml:186-187:[tool.setuptools.dynamic]/version = {attr = "neo4j._meta.version"}. Upstream substitutes the release version only inbin/dist-functions(set_versiondoessed -i 's/^version = .*/version = "$1"/g'and reverts it afterwards); neitherdebian/rulesnor pybuild does this. - Problem: The orig tarball is the GitHub tag archive (
neo4j-python-driver-6.4.1/), which contains the unreleased6.4.dev0string; the release sdist produced bybin/make-distwould have had it replaced. Pybuild runspython3 -m build --no-isolationwith the setuptools backend, which reads the version fromneo4j._meta.version, so the wheel and installed dist-info areneo4j-6.4.dev0andneo4j.__version__is6.4.dev0although the Debian package is 6.4.1. The same value feedsdocs/source/conf.py(release), so the shipped documentation also calls itself 6.4.dev0.importlib.metadata.version("neo4j")is then a prerelease older than 6.4, which misleads tools and users comparing versions. - Fix: Add a patch setting
version = "6.4.1"insrc/neo4j/_meta.py(and forward it upstream), or build from upstream's released sdist where the version is already substituted, so the built module's metadata and__version__match the package version.
Verified ◂
- Read every file in debian/ (control, rules, changelog, copyright, source/format, gbp.conf, salsa-ci.yml, upstream/metadata, the .docs and doc-base files) and all three patches; no patch creates a file.
- Walked the upstream tree directory by directory (src, tests, docs, testkit, testkitbackend, benchkit, benchmarks, bin, .github, top-level files, 544 files per the prescan); every program file carries the Apache-2.0 Neo4j header and is covered by
Files: *. - The PSF-2.0 excerpts in src/neo4j/_async_compat/concurrency.py, src/neo4j/_async_compat/shims/_wait_for.py and tests/conftest.py retain their PSF notices and are covered by their stanzas; no other CPython-derived code was found.
- No non-free wording (non-commercial, no-modification, field-of-use, research-only and the like) anywhere in the tree.
- The prescan's minified file, docs/source/themes/neo4j/static/css/site.css, is the third-party-derived CSS bundle reported above; it is not generated from neo4j.css_t.
- docs/source/themes/ is not used by the build: use-local-theme.patch sets
html_theme = "alabaster", and python-neo4j-doc.docs installs only_build/html/, so the fonts and site.css reach no binary package. - The only other binary files are docs/source/_images/core_type_mappings.png (its SVG source is beside it) and docs/source/themes/neo4j/static/menu.svg.
- pytz is genuinely used at runtime (hence Depends: python3-pytz); aiohttp/urllib3 are reached only through the network package's lazy
__getattr__, so Suggests is right; typing_extensions imports are TYPE_CHECKING- or version-guarded. - Build dependencies suffice for the actual build: pybuild-plugin-pyproject pulls python3-build and python3-installer, python3-sphinx depends on python3-alabaster, the sphinx run in execute_after_dh_auto_build is outside the test step (so python3-sphinx is correctly not <!nocheck>), and pybuild copies tests/ into its build dir before
pytest tests/unit. - doc-base's
Files: ...html/*.htmlwildcard is normal: the same form is used by debian-policy, the Debian FAQ and others in /usr/share/doc-base. - Packaging checks: Standards-Version 4.7.4 is current against Policy 4.7.4.1, the changelog is an initial release to unstable closing #1151494, debhelper compat 14 means missing relationship substvars in debian/control are not a fault, and both binary packages are Architecture: all with Multi-Arch: foreign as other arch:all Python modules are.
- uscan found the packaged version as the newest upstream release (upstream
6.4.1, packaged6.4.1). - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (Apache-2.0).
Not confirmed ◂
- The woff2 files were not opened: that they are Google's Nunito Sans under SIL OFL 1.1 is inferred from the file names and from the Google-Fonts-style nunito-sans.css, not read from the binaries.
- Whether python3-pyarrow exists on loong64 and riscv64, where Build-Depends lists it; the package lists available here cover only the archive's main architectures.
- The build was not run (as instructed), so the 6.4.dev0 wheel metadata was established from pyproject.toml, src/neo4j/_meta.py, bin/dist-functions and pybuild's build path, not from a built wheel.
- Why the model asked for what a review has no use for. During this review it asked once for something outside the package and the reviewing system (another file of the sandbox, or a URL), or was given part of the review tooling's own configuration, and that was refused or withheld. A model does this when something it has read tells it to, so look in the package for text addressed to a reviewing program, and treat this report with suspicion. Refused:
read: "xd://read/sources" is not a file of the package or of the reviewing system.
Proposed changes ◂
None.
Uploader's response to the LLM review
Waiting for the uploader's response until , because the review found serious issues.