DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: python-polars 2.1.0-1

Package Information

Descriptionfast, multithreaded DataFrame library for Python

Polars provides DataFrames for working with tabular data in Python. It supports filtering, joins, grouping, aggregation and statistical operations, with an expression API for combining transformations and a SQL interface.

Its Rust engine uses a columnar memory representation based on Apache Arrow and executes operations across multiple processor cores. Queries can run eagerly or use a lazy API that optimizes a sequence of operations before execution. Streaming execution can process data in batches to reduce memory use for supported queries.

This package provides the Python interface and its native runtime, with support for local CSV, JSON, Parquet and Arrow IPC files. Cloud provider backends, cloud catalogs and the Polars Cloud client are disabled in this build.

MaintainerDebian Python Team <team+python@tracker.debian.org>
Changed BySteffen Moeller <moeller@debian.org>
Sponsormoeller@debian.org
Distributionunstable
Architectureany
VCSgit: https://salsa.debian.org/debian/polars.git (browse)
Closes#1144965
Trackerhttps://tracker.debian.org/pkg/python-polars
Uploaded2 hours ago

New Package Report

.changes◂
Version2.1.0-1
Changed-BySteffen Moeller <moeller@debian.org>
Architecturesource amd64
Distributionunstable
DateSat, 31 Oct 2026 01:00:00 +0100
Sourcepython-polars
Changelog◂
python-polars (2.1.0-1) unstable; urgency=medium
 .
   * Initial release of Python Polars 2.1.0 (Closes: #1144965).
 .
   * Clean generated native-runtime feature flags before source packaging.
   * Default to one native compiler job, disable LTO and incremental/debug
     output, and use the GNU BFD linker with reduced memory retention.
     Refresh Cargo configuration when resuming a build.
   * Record embedded Rust and native sources with dh-cargo-built-using.
   * Declare Apache Avro 0.22 for Cargo workspace resolution and wheel
     for the frontend build backend.
   * Drop the separate PyPI runtime dependency from frontend metadata;
     the matching native runtime is bundled in python3-polars.
   * Complete native compatibility: provide hash-table prefetch fallbacks,
     use the shared NumPy type API and handle cloud-disabled metadata reads.
   * Restrict Cargo resolution to the selected local runtime workspace and
     omit unavailable optional backends and disabled dependency features.
   * Declare the required argminmax 0.7 and bincode 2 versions, and add
     Cargo resolver dependencies on lz4-flex and murmur3.
   * Adapt compact_str to 0.10 and fs4 to 0.13; preserve file-lock contention
     handling. Use Apache Avro 0.22 for upstream Rust integration tests.
   * Use Debian's hashbrown 0.16.1, retaining Rayon and Serde support.
   * Support Debian's PyO3 0.28 and matching Rust NumPy bindings; adapt
     Arrow capsule construction while retaining the 0.29 dependency series.
   * Allow libloading 0.8.9 and 0.9 for native plugin loading.
   * Omit the plugin-SDK serde-pickle dependency from the runtime build.
   * Omit Wasm-only random backends and use Debian's getrandom 0.4.
   * Build the matching Python native runtime from the bundled Rust sources,
     retaining their independent upstream crate versions (0.55.1).
   * Select a local-file runtime with CSV, JSON, Parquet, Arrow IPC, SQL and
     streaming support; disable cloud providers, cloud catalogs and the Polars
     Cloud client, and omit unused AWS SDK build dependencies.
   * Use Debian's packaged Rust dependencies through the Cargo wrapper;
     remove upstream Git overrides and the lockfile for Debian resolution.
   * Track Python release tags in debian/watch and document the Python/Rust
     versioning scheme and remaining dependency work in debian/README.source
     and debian/README.Debian.
   * Audit bundled crate copyright, including Snappy, DataFusion/Redis,
     NumPy, Rust/Unicode, InfluxData and other borrowed code. Record BSD,
     Boost and Unicode terms and check crates/ with scoped lrc aliases.
.dsc◂
Componentmain
Package-Listpython3-polars deb python optional arch=any
Sectionpython
Priorityoptional
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: Polars
Source: https://github.com/pola-rs/polars

Files: *
Copyright:
 2025 Ritchie Vink
 2024 (Some portions) NVIDIA CORPORATION & AFFILIATES.
License: Expat

Files:
 crates/polars-arrow/*
 crates/polars-parquet/*
 crates/polars-compute/src/gather/binary.rs
 crates/polars-compute/src/gather/fixed_size_list.rs
 crates/polars-compute/src/gather/list.rs
 crates/polars-compute/src/gather/mod.rs
 crates/polars-compute/src/gather/structure.rs
Copyright:
 2020-2022 Jorge C. Leitão
 The Apache Software Foundation and its contributors
 2025 Ritchie Vink
 2024 (Some portions) NVIDIA CORPORATION & AFFILIATES
License: Apache-2.0 and Expat
Comment: The polars-arrow and polars-parquet crates contain code taken from
 arrow2 and parquet2 in October 2023, under Apache-2.0. The handwritten
 Thrift code in polars-parquet was ported from apache/arrow-rs 57.0 in
 April 2026; encryption code was ported from arrow-rs 60.0 in September
 2026. The gather files listed above also carry Apache-2.0 notices.
 Later Polars changes are covered by the Expat license in the top-level
 LICENSE file. These are licenses for different portions of the code,
 rather than a choice of licenses for the same code.

Files:
 crates/polars-parquet/src/parquet/snappy.rs
Copyright:
 2011 The Snappy-Rust Authors
 2025 Ritchie Vink
 2024 (Some portions) NVIDIA CORPORATION & AFFILIATES
License: BSD-3-clause and Expat
Comment: Contains the snap 1.1.2 decompressor, adapted to write into
 uninitialized memory. Its BSD-3-clause notice is embedded in this file;
 later Polars changes are under Expat.

Files:
 crates/polars-compute/src/hyperloglogplus.rs
Copyright:
 The Apache Software Foundation and its contributors
 2014 Salvatore Sanfilippo <antirez at gmail dot com>
 2017-2018 The pdatastructures Developers
 2025 Ritchie Vink
 2024 (Some portions) NVIDIA CORPORATION & AFFILIATES
License: Apache-2.0 and BSD-3-clause and Expat
Comment: Borrows Apache-2.0 code from DataFusion revision
 93771052c5ac31f2cf22b8c25bf938656afe1047. That implementation also
 derives from Redis revision 4930d19e70c391750479951022e207e19111eb55
 (BSD-3-clause), and borrows structure from pdatastructs.rs revision
 3997ed50f6b6871c9e53c4c5e0f48f431405fc63 (Expat option selected).
 The corresponding upstream notices are at:
 https://github.com/apache/datafusion/blob/93771052c5ac31f2cf22b8c25bf938656afe1047/datafusion/physical-expr/src/aggregate/hyperloglog.rs
 https://github.com/redis/redis/blob/4930d19e70c391750479951022e207e19111eb55/src/hyperloglog.c
 https://github.com/crepererum-oss/pdatastructs.rs/blob/3997ed50f6b6871c9e53c4c5e0f48f431405fc63/LICENSE-MIT

Files:
 crates/polars-parquet/src/parquet/handwritten_thrift/parquet_macros.rs
Copyright:
 The Apache Software Foundation and its contributors
 Jörn Horstmann <git@jhorstmann.net>
 2025 Ritchie Vink
 2024 (Some portions) NVIDIA CORPORATION & AFFILIATES
License: Apache-2.0 and Expat
Comment: The Arrow Thrift macros additionally credit Jörn Horstmann's
 compact-thrift macros. The original runtime declares Apache-2.0 in
 https://github.com/jhorstmann/compact-thrift/blob/main/runtime/Cargo.toml.

Files:
 crates/polars-parquet/src/parquet/encoding/bitpacked/pack.rs
Copyright:
 2016 Paul Masurel
 2020-2022 Jorge C. Leitão
 2025 Ritchie Vink
 2024 (Some portions) NVIDIA CORPORATION & AFFILIATES
License: Apache-2.0 and Expat
Comment: The packing implementation is adapted from bitpacking.
 See https://github.com/quickwit-oss/bitpacking/blob/master/LICENSE.
 Expat covers bitpacking and later Polars changes; Apache-2.0 covers
 parquet2-derived portions under the enclosing crate's licence notice.

Files:
 crates/polars-ops/src/series/ops/business.rs
Copyright:
 2011 Enthought, Inc.
      Mark Wiebe <mwwiebe@gmail.com>
 2005-2024 NumPy Developers
 2025 Ritchie Vink
 2024 (Some portions) NVIDIA CORPORATION & AFFILIATES
License: BSD-3-clause and Expat
Comment: The business-day count and offset implementations are ported from
 NumPy's datetime_busday.c at revision
 e59c074842e3f73483afa5ddef031e856b9fd313. That file credits Enthought;
 NumPy's accompanying LICENSE.txt supplies the BSD-3-clause terms.
 See https://github.com/numpy/numpy/blob/e59c074842e3f73483afa5ddef031e856b9fd313/numpy/_core/src/multiarray/datetime_busday.c.

Files:
 crates/polars-async/src/executor/mod.rs
 crates/polars-async/src/executor/task.rs
 crates/polars-ops/src/chunked_array/strings/case.rs
 crates/polars-ops/src/chunked_array/strings/unicode_internals/mod.rs
 crates/polars-row/src/fixed/numeric.rs
 crates/polars-utils/src/chunked_bytes_cursor.rs
 crates/polars-utils/src/range.rs
Copyright:
 The Rust Project Developers and contributors
 2025 Ritchie Vink
 2024 (Some portions) NVIDIA CORPORATION & AFFILIATES
License: Expat
Comment: Contain code copied or adapted from the Rust standard library.
 The Expat option is selected for the Rust code. Rust's copyright policy
 and dual-licence grant are recorded in
 https://github.com/rust-lang/rust/blob/1.70.0/COPYRIGHT.
 The generated Unicode property tables are recorded separately below.

Files:
 crates/polars-ops/src/chunked_array/strings/unicode_internals/unicode_data.rs
Copyright:
 The Rust Project Developers and contributors
 1991-2022 Unicode, Inc.
 2025 Ritchie Vink
 2024 (Some portions) NVIDIA CORPORATION & AFFILIATES
License: Expat and Unicode-DFS-2016
Comment: Contains Rust Unicode lookup helpers and the Case_Ignorable and
 Cased property tables for Unicode 15.0.0. Both property modules match
 Rust 1.70.0's unicode_data.rs byte for byte; the lookup helper differences
 are formatting. The Expat option covers the Rust code and Polars changes;
 the Unicode data licence reproduced below covers the derived data.
 See https://github.com/rust-lang/rust/blob/1.70.0/library/core/src/unicode/unicode_data.rs
 and the Unicode notice in that release's COPYRIGHT file.

Files:
 crates/polars-core/src/chunked_array/from_iterator_par.rs
Copyright:
 2010 The Rust Project Developers
 2025 Ritchie Vink
 2024 (Some portions) NVIDIA CORPORATION & AFFILIATES
License: Expat
Comment: Contains iterator collection code copied or adapted from Rayon.
 The Expat option is selected; its notice is in
 https://github.com/rayon-rs/rayon/blob/v1.3.1/LICENSE-MIT.

Files:
 crates/polars-core/src/hashing/vector_hasher.rs
Copyright:
 2018 Tom Kaitchuck
 2025 Ritchie Vink
 2024 (Some portions) NVIDIA CORPORATION & AFFILIATES
License: Expat
Comment: Contains code inlined from aHash. The Expat option is selected.
 See https://github.com/tkaitchuck/aHash/blob/f9acd508bd89e7c5b2877a9510098100f9018d64/LICENSE-MIT.

Files:
 crates/polars-utils/src/hashing.rs
Copyright:
 2005-2014 Daniel James
 2025 Ritchie Vink
 2024 (Some portions) NVIDIA CORPORATION & AFFILIATES
License: BSL-1.0 and Expat
Comment: The _boost_hash_combine helper is adapted from Boost's hash_combine.
 The corresponding Boost notice is in
 https://github.com/boostorg/container_hash/blob/boost-1.78.0/include/boost/container_hash/hash.hpp.

Files:
 crates/polars-json/src/json/write/utf8.rs
Copyright:
 Erick Tryzelaar <erick.tryzelaar@gmail.com>
 David Tolnay <dtolnay@gmail.com>
 2025 Ritchie Vink
 2024 (Some portions) NVIDIA CORPORATION & AFFILIATES
License: Expat
Comment: Adapted from serde_json revision
 f901012df66811354cb1d490ad59480d8fdf77b5. The Expat option is selected;
 the original Cargo.toml names the authors and the licence choice.
 See https://github.com/serde-rs/json/blob/f901012df66811354cb1d490ad59480d8fdf77b5/Cargo.toml.

Files:
 crates/polars-compute/src/rolling/no_nulls/quantile.rs
Copyright:
 2012-2016 Dahua Lin, Simon Byrne, Andreas Noack, Douglas Bates,
           John Myles White, Simon Kornblith, and other contributors
 2025 Ritchie Vink
 2024 (Some portions) NVIDIA CORPORATION & AFFILIATES
License: Expat
Comment: The weighted quantile implementation credits Julia's StatsBase.jl.
 Its MIT notice names the contributors listed above; see
 https://github.com/JuliaStats/StatsBase.jl/blob/v0.33.21/LICENSE.md.

Files:
 crates/polars-time/src/windows/*
 crates/polars-defs/src/time/duration.rs
Copyright:
 2013-2018 InfluxData Inc.
 2020 InfluxData
 2025 Ritchie Vink
 2024 (Some portions) NVIDIA CORPORATION & AFFILIATES
License: Expat
Comment: The windowing code credits ports from InfluxDB IOx and Flux;
 their duration representation is now in polars-defs. Flux's original
 notices are at the revisions cited by windows/mod.rs:
 https://github.com/influxdata/flux/blob/3d6c47d9113fe0d919ddd3d4eef242dfc38ab2fb/LICENSE
 https://github.com/influxdata/flux/blob/1e9bfd49f21c0e679b42acf6fc515ce05c6dec2b/LICENSE
 The former IOx repository is no longer available at its original URL;
 its historical source and MIT notice are preserved in
 https://github.com/metrico/influxdb_iox/blob/main/query_functions/src/window/internal.rs
 and https://github.com/metrico/influxdb_iox/blob/main/LICENSE-MIT.
 The MIT option is selected for IOx's MIT OR Apache-2.0 grant.

Files:
 crates/polars-io/src/cloud/credential_provider.rs
Copyright:
 2020-2024 The Apache Software Foundation
 2025 Ritchie Vink
 2024 (Some portions) NVIDIA CORPORATION & AFFILIATES
License: Apache-2.0 and Expat
Comment: The split_sas helper is copied and adjusted from object_store's
 Azure builder at revision 7a0504b4924fcecee17d768fd7190b8f71b0877f.
 The source header grants Apache-2.0; the accompanying NOTICE.txt supplies
 the copyright notice. This applies even when cloud support is disabled.
 See https://github.com/apache/arrow-rs-object-store/blob/7a0504b4924fcecee17d768fd7190b8f71b0877f/src/azure/builder.rs.

Files: py-polars/src/polars/_cpu_check.py
Copyright: 2014 Anders Høst
 2025 Ritchie Vink
 2024 (Some portions) NVIDIA CORPORATION & AFFILIATES
License: Expat
Comment: Contains code vendored from https://github.com/flababah/cpuid.py.

Files: crates/polars-utils/src/levenshtein.rs
Copyright:
 2016 Titus Wormer <tituswormer@gmail.com>
 2025 Ritchie Vink
 2024 (Some portions) NVIDIA CORPORATION & AFFILIATES
License: Expat
Comment: Based on https://github.com/wooorm/levenshtein-rs/blob/9c4730b1973d4e61e187f8fe6d5f299ad5c991fc/src/lib.rs.

Files: py-polars/src/polars/_utils/nest_asyncio.py
Copyright:
 2025 Ritchie Vink
 2018-2020 Ewald de Wit. All rights reserved.
License: BSD-2-clause
Comment: Vendored from https://github.com/Chaoses-Ib/nest-asyncio2.

Files: docs/source/_build/css/extra.css
Copyright: 2025 Ritchie Vink
 2024 (Some portions) NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 2023 Fonticons, Inc.
License: Expat and CC-BY-4.0
Comment: The CSS contains an embedded Rust SVG icon from Font Awesome Free
 6.4.0. The icon is licensed under CC-BY-4.0; the surrounding Polars CSS
 is licensed under Expat. The icon's attribution is retained in the
 embedded SVG comment.
 See https://github.com/FortAwesome/Font-Awesome/blob/6.4.0/LICENSE.txt.

Files: debian/*
Copyright: 2026 Debian Polars Maintainers
License: Expat

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 https://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the full text of the Apache License, Version 2.0,
 can be found in /usr/share/common-licenses/Apache-2.0.

License: BSD-2-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
 * Redistributions of source code must retain the above copyright notice, this
   list of conditions and the following disclaimer.
 .
 * Redistributions in binary form must reproduce the above copyright notice,
   this list of conditions and the following disclaimer in the documentation
   and/or other materials provided with the distribution.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
 FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
 CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

License: CC-BY-4.0
 The Font Awesome SVG icon is licensed under the Creative Commons
 Attribution 4.0 International License.
 .
 On Debian systems, the full text of the license can be found in
 /usr/share/common-licenses/CC-BY-4.0.

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
 * Redistributions of source code must retain the above copyright notice,
   this list of conditions and the following disclaimer.
 .
 * Redistributions in binary form must reproduce the above copyright notice,
   this list of conditions and the following disclaimer in the documentation
   and/or other materials provided with the distribution.
 .
 * Neither the name of the copyright holder nor the names of its contributors
   may be used to endorse or promote products derived from this software
   without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
 LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 POSSIBILITY OF SUCH DAMAGE.

License: BSL-1.0
 On Debian systems, the full text of the Boost Software License, Version 1.0,
 is in /usr/share/common-licenses/BSL-1.0.

License: Unicode-DFS-2016
 UNICODE, INC. LICENSE AGREEMENT - DATA FILES AND SOFTWARE
 .
 See Terms of Use <https://www.unicode.org/copyright.html>
 for definitions of Unicode Inc.’s Data Files and Software.
 .
 NOTICE TO USER: Carefully read the following legal agreement.
 BY DOWNLOADING, INSTALLING, COPYING OR OTHERWISE USING UNICODE INC.'S
 DATA FILES ("DATA FILES"), AND/OR SOFTWARE ("SOFTWARE"),
 YOU UNEQUIVOCALLY ACCEPT, AND AGREE TO BE BOUND BY, ALL OF THE
 TERMS AND CONDITIONS OF THIS AGREEMENT.
 IF YOU DO NOT AGREE, DO NOT DOWNLOAD, INSTALL, COPY, DISTRIBUTE OR USE
 THE DATA FILES OR SOFTWARE.
 .
 COPYRIGHT AND PERMISSION NOTICE
 .
 Copyright © 1991-2022 Unicode, Inc. All rights reserved.
 Distributed under the Terms of Use in https://www.unicode.org/copyright.html.
 .
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of the Unicode data files and any associated documentation
 (the "Data Files") or Unicode software and any associated documentation
 (the "Software") to deal in the Data Files or Software
 without restriction, including without limitation the rights to use,
 copy, modify, merge, publish, distribute, and/or sell copies of
 the Data Files or Software, and to permit persons to whom the Data Files
 or Software are furnished to do so, provided that either
 (a) this copyright and permission notice appear with all copies
 of the Data Files or Software, or
 (b) this copyright and permission notice appear in associated
 Documentation.
 .
 THE DATA FILES AND SOFTWARE ARE PROVIDED "AS IS", WITHOUT WARRANTY OF
 ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
 WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
 NONINFRINGEMENT OF THIRD PARTY RIGHTS.
 IN NO EVENT SHALL THE COPYRIGHT HOLDER OR HOLDERS INCLUDED IN THIS
 NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL
 DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
 DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
 TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 PERFORMANCE OF THE DATA FILES OR SOFTWARE.
 .
 Except as contained in this notice, the name of a copyright holder
 shall not be used in advertising or otherwise to promote the sale,
 use or other dealings in these Data Files or Software without prior
 written authorization of the copyright holder.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 hour ago.

Proposes a replacement debian/watch: debian/watch in version 5 format

Report◂

DFSG NEW review for python-polars version 2.1.0-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: Yes
  • Packaging is of good quality: Yes
  • Issues: 0 blocker, 0 important, 2 minor
  • debian/watch: old format (version 4)
  • debian/copyright: machine-readable
  • Scan before the review: 47 found

Licensing

debian/copyright is DEP-5 and unusually thorough. The root Expat (MIT) licence of the top-level LICENSE, the Apache-2.0 portions in polars-arrow and polars-parquet, and the BSD-3-clause (snap), BSD-2-clause (nest-asyncio), BSL-1.0 (Boost hash_combine), Unicode-DFS-2016 (Unicode property tables) and CC-BY-4.0 (Font Awesome icon in extra.css) parts each have their own stanza, with a full text or a /usr/share/common-licenses pointer for every short name used. Every copyright holder I found in the tree is named, including the Titus Wormer notice in crates/polars-utils/src/levenshtein.rs that the pre-scan flagged. All licences are free and mutually compatible, and the orig tarball is pristine, so no Files-Excluded is needed.

Packaging

The packaging is careful and current: debhelper compat 13, pybuild for the pure-Python frontend plus an explicit cargo build of the private native runtime, dh-cargo-built-using recorded in Built-Using/Static-Built-Using, Build-Depends versions all satisfiable in the archive, twelve patches all carrying DEP-3 headers, an autopkgtest, and an up-to-date Standards-Version. The one fault is that build settings tuned for the maintainer's laptop are imposed on every build, including the archive buildds: Rust debug information is deliberately switched off and a single compiler job is forced.

Issues

minor packaging 1. Release build deliberately disables Rust debug information and forces one compiler job for every build ◂
  • Files: debian/rules:14-21, debian/README.source
  • Basis: checked, in the package or with a reference tool
  • Evidence: debian/rules: # The native runtime exceeds this laptop's RAM with concurrent rustc jobs. / POLARS_CARGO_JOBS ?= 1 / export CARGO_BUILD_JOBS = $(POLARS_CARGO_JOBS) / export CARGO_PROFILE_RELEASE_DEBUG = false / export RUSTFLAGS += -C debuginfo=0 -C link-arg=-fuse-ld=bfd -C link-arg=-Wl,--no-keep-memory; README.source: Rust debugging information is sacrificed to keep compiler and linker output smaller and The native runtime uses one compiler job, no incremental compilation, no Rust debug information.
  • Problem: Policy 10.1 says that by default any binaries created when a package is built should include debugging information. Debian's own cargo wrapper (/usr/share/cargo/bin/cargo, prepare_rustflags/prepare_debian) generates -C debuginfo=2 and [profile.release] debug = true exactly so that dh_strip's automatic -dbgsym package is useful; these settings override both, so the dbgsym package for this large native library will contain no DWARF and crash reports from users cannot be symbolised. CARGO_BUILD_JOBS=1 is also imposed regardless of the buildd's DEB_BUILD_OPTIONS=parallel=N (the maintainer records a 2h15m build), which multiplies the time the archive spends on every architecture; a lower parallelism is not itself a policy breach, but neither is it a sensible archive-wide default.
  • Fix: Drop CARGO_PROFILE_RELEASE_DEBUG = false and -C debuginfo=0 from the exported variables so the wrapper's debug settings apply (memory use can still be limited with --config profile.release.debug=false in a local build), and let CARGO_BUILD_JOBS be unset or default to the buildd's parallelism, keeping POLARS_CARGO_JOBS as an opt-in override for small machines.
minor packaging 2. debian/watch is in the old version 4 format ◂
  • Files: debian/watch
  • Basis: found by the review tooling's own checks
  • Evidence: version=4
  • Problem: Version 5 is the current format of debian/watch.
  • Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.
Verified ◂
  • debian/copyright read in full: DEP-5, Files: * Expat, 14 further Files stanzas with full licence texts for Expat, BSD-2-clause, BSD-3-clause and Unicode-DFS-2016 and common-licenses pointers for Apache-2.0, CC-BY-4.0 and BSL-1.0. Every path it names exists in the tree.
  • Licence sweep over crates/, py-polars/, pyo3-polars/, docs/, tools/, examples/ and .github/: no SPDX tags anywhere; inline notices exist only in crates/polars-parquet/src/parquet/snappy.rs:7 (BSD-3, stanza present), py-polars/src/polars/_cpu_check.py:4 (MIT, stanza present), py-polars/src/polars/_utils/nest_asyncio.py:5 (BSD-2, stanza present) and LICENSE files; Apache headers occur in exactly the eight files the crates/polars-arrow/*, crates/polars-parquet/* and gather-file stanzas cover.
  • No GPL/LGPL/MPL wording, no non-commercial, no-modification, field-of-use or "Good, not Evil" terms, no CC-*-NC/-ND anywhere in the tree (grep for Commons Clause, Business Source, Elastic License, NonCommercial, personal/research-use-only: no matches).
  • Pre-scan holder report: the only flagged name, 2016 Titus Wormer <tituswormer@gmail.com> (crates/polars-utils/src/levenshtein.rs:2), is named in that file's own stanza, so nothing is missing.
  • Licence files: the 38 crates/*/LICENSE copies are byte-identical MIT texts matching Files: *, except crates/polars-arrow/LICENSE and crates/polars-parquet/LICENSE, which add the arrow2/parquet2 Apache-2.0 notice and match their stanzas; crates/polars-config/LICENSE is an empty (0 byte) file, which is harmless because the root LICENSE governs.
  • Spreadsheet and compressed test fixtures, read as data only: py-polars/tests/unit/io/files/empty.ods, py-polars/tests/unit/io/files/empty.xls, py-polars/tests/unit/io/files/empty.xlsb, py-polars/tests/unit/io/files/empty.xlsx, py-polars/tests/unit/io/files/example.ods, py-polars/tests/unit/io/files/example.xls, py-polars/tests/unit/io/files/example.xlsb, py-polars/tests/unit/io/files/example.xlsx, py-polars/tests/unit/io/files/mixed.ods, py-polars/tests/unit/io/files/mixed.xlsb, py-polars/tests/unit/io/files/mixed.xlsx, py-polars/tests/unit/io/files/nan_test.xlsx, py-polars/tests/unit/io/files/test_empty_rows.xlsx, py-polars/tests/unit/io/files/gzipped.csv.gz, py-polars/tests/unit/io/files/zstd_compressed.csv.zst. Inputs for the spreadsheet and compressed-CSV reader tests, not built programs; no preferred form for modification is missing for them.
  • Parquet and IPC test fixtures, read as data only: py-polars/tests/unit/io/files/concatenated_gzip_members.parquet, py-polars/tests/unit/io/files/empty_datapage_v2.snappy.parquet, py-polars/tests/unit/io/files/foods1.ipc, py-polars/tests/unit/io/files/foods1.parquet, py-polars/tests/unit/io/files/foods2.ipc, py-polars/tests/unit/io/files/foods2.parquet, py-polars/tests/unit/io/files/nested_maps.snappy.parquet, py-polars/tests/unit/io/files/old_list_structure.parquet, py-polars/tests/unit/io/files/repeated_no_annotation.parquet, py-polars/tests/unit/io/files/small.parquet, py-polars/tests/unit/io/files/tz_aware.parquet. Reader test data, not compiled or generated artifacts.
  • Delta-table test data, read as data only: py-polars/tests/unit/io/files/delta-table/part-00000-e42312d7-60e5-454d-acbc-db192d220e73-c000.snappy.parquet, py-polars/tests/unit/io/files/delta-table/.part-00000-e42312d7-60e5-454d-acbc-db192d220e73-c000.snappy.parquet.crc, py-polars/tests/unit/io/files/delta-table/part-00000-e4a999da-df45-4fb0-bdc4-d999fc0f58aa-c000.snappy.parquet, py-polars/tests/unit/io/files/delta-table/.part-00000-e4a999da-df45-4fb0-bdc4-d999fc0f58aa-c000.snappy.parquet.crc, py-polars/tests/unit/io/files/delta-table/_delta_log/.00000000000000000000.json.crc, py-polars/tests/unit/io/files/delta-table/_delta_log/.00000000000000000001.json.crc. A two-version Delta table fixture plus its checksum files, for the Delta reader test.
  • Iceberg-table test data, read as data only: py-polars/tests/unit/io/files/iceberg-table/data/ts_day=2023-03-01/00000-1-6bc54766-6e8a-4fd5-8c00-c6bacbdcaeeb-00001.parquet, py-polars/tests/unit/io/files/iceberg-table/data/ts_day=2023-03-01/.00000-1-6bc54766-6e8a-4fd5-8c00-c6bacbdcaeeb-00001.parquet.crc, py-polars/tests/unit/io/files/iceberg-table/data/ts_day=2023-03-02/00000-1-6bc54766-6e8a-4fd5-8c00-c6bacbdcaeeb-00002.parquet, py-polars/tests/unit/io/files/iceberg-table/data/ts_day=2023-03-02/.00000-1-6bc54766-6e8a-4fd5-8c00-c6bacbdcaeeb-00002.parquet.crc, py-polars/tests/unit/io/files/iceberg-table/metadata/aef5d952-7e24-4764-9b30-3483be37240f-m0.avro, py-polars/tests/unit/io/files/iceberg-table/metadata/snap-7051579356916758811-1-aef5d952-7e24-4764-9b30-3483be37240f.avro. A two-snapshot Iceberg table fixture (data files, checksum files and manifests) for the Iceberg reader test.
  • docs/assets/data/alltypes_plain.parquet is a small documentation sample used by docs/source/src/python/user-guide/transformations/sql/select.py, and examples/datasets/pds_heads/customer.feather, examples/datasets/pds_heads/lineitem.feather, examples/datasets/pds_heads/nation.feather, examples/datasets/pds_heads/orders.feather, examples/datasets/pds_heads/part.feather, examples/datasets/pds_heads/partsupp.feather, examples/datasets/pds_heads/region.feather, examples/datasets/pds_heads/supplier.feather are TPC-H style table heads read by the pdsh test at crates/polars-lazy/src/tests/pdsh.rs:9. Both sets are data fixtures, not built files.
  • Packaging files read in full: control, rules, changelog, copyright, clean, lrc.config, README.Debian, README.source, salsa-ci.yml, source/format, source/options, tests/control, tests/smoke, upstream/metadata and all twelve patches with series; no maintainer scripts, and no .install/.links/.docs files are needed.
  • Build-Depends checked against the archive with apt-cache: dh-cargo 34 (>= 34), librust-libloading-dev 0.8.9 (>= 0.8.9, < 0.10), librust-hashbrown-0.16-dev provided by librust-hashbrown-dev 0.16.1, librust-pyo3-dev 0.29.3 (< 0.30), librust-numpy-dev 0.28.0, librust-argminmax-dev 0.7.1, librust-apache-avro-dev 0.22.0, librust-getrandom-dev 0.4.2, librust-compact-str-dev 0.10.0, librust-jsonpath-lib-polars-vendor-dev 0.0.1 all exist and satisfy the declared versions.
  • All twelve patches carry Description, Author, Forwarded and Last-Update; series lists all twelve. Forwarded: not-needed is plausible for Debian-local dependency-resolution changes; no patch removes tests or deletes licence notices.
  • Source package: Format 3.0 (quilt), pristine python-polars_2.1.0.orig.tar.gz, no repacking, no Files-Excluded needed; debian/clean removes the build_feature_flags.py that py-polars/runtime/polars-runtime-32/build.rs writes into the source tree, and rules installs it with __init__.py and the built _polars_runtime.abi3.so under dist-packages, matching what py-polars/src/polars/_plr.py imports.
  • Standards-Version 4.7.4 against Policy 4.7.4.1: current. optimize=-lto in DEB_BUILD_MAINT_OPTIONS is a valid feature of the optimize area (dpkg-buildflags(1)). Docs-only JS (docs/source/_build/js/mathjax.js, docs/source/_build/js/posthog-init.js) is documentation-site configuration/snippet code and is not installed by any binary package.
  • uscan found the packaged version as the newest upstream release (upstream 2.1.0, packaged 2.1.0).
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0, BSL-1.0, CC-BY-4.0).
Not confirmed ◂
  • Provenance of the parquet, IPC and avro fixtures: several filenames (alltypes_plain.parquet, nested_maps.snappy.parquet, old_list_structure.parquet, repeated_no_annotation.parquet, concatenated_gzip_members.parquet, empty_datapage_v2.snappy.parquet) are those of Apache Arrow's parquet-testing data, and the delta-table and iceberg-table fixtures resemble Spark and Iceberg test data. The files are binary and I did not read their embedded metadata, so whether an Apache-2.0 acknowledgement is missing for them could not be established.
  • The provenance and licence of the documentation samples docs/assets/data/pokemon.csv, docs/assets/data/reddit.csv, docs/assets/data/apple_stock.csv, docs/assets/data/monopoly_props_groups.csv, docs/assets/data/monopoly_props_prices.csv and docs/assets/data/iris.csv is stated nowhere; I treated them as upstream sample data covered by Files: *.
  • The build itself was not run; I could not observe whether the compiled runtime imports and the smoke test pass.
Proposed: debian/watch in version 5 format ◂

debian/watch is in an old format. This is the conversion made by uscan --update-watchfile, which has not been run against the upstream site: some defaults differ in version 5, so test it with uscan --report before use.

Version: 5

# Follow Python releases; rs-* tags use an independent Rust crate version.
Template: Github
Dist: https://github.com/pola-rs/polars

Uploader's response to the LLM review

The uploader was emailed about the review 1 hour ago.

Review Information

accepted — allocated to mechtilde 1 hour ago, started 1 hour ago, completed 1 hour ago.

Final Comment

Back to Dashboard | View all reviews for this package