DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: r-cran-tinytable 0.19-1

New Package Report

.changes◂
Distributionunstable
DateSat, 31 Oct 2026 11:35:43 -0500
Sourcer-cran-tinytable
Version0.19-1
Changed-ByDirk Eddelbuettel <edd@debian.org>
Architecturesource all
Changelog◂
r-cran-tinytable (0.19-1) unstable; urgency=low
 .
   * Initial Debian release			(Closes: #1152468)
 .
   * debian/copyright: Refined based on upstream and review comments
.dsc◂
Sectiongnu-r
Priorityoptional
Componentmain
Package-Listr-cran-tinytable deb gnu-r optional arch=all
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: tinytable
Comment:
 This is the Debian GNU/Linux r-cran-tinytable package of tinytable. The
 tinytable package creates tables in various formats, and was written by
 Vincent Arel-Bundock.Søren Højsgaard and
 .
 This package was created by Dirk Eddelbuettel <edd@debian.org>.
 .
 The package was renamed from its upstream name 'tinytable' to
 'r-cran-tinytable' to fit the pattern of CRAN (and non-CRAN) packages
 for R.
 .
 For reference, the upstream DESCRIPTION file is included below:
 .
 Package: tinytable
 Type: Package
 Title: Simple and Configurable Tables in 'HTML', 'LaTeX', 'Markdown',
         'Word', 'PNG', 'PDF', and 'Typst' Formats
 Description: Create highly customized tables with this simple and dependency-free package. Data frames can be converted to 'HTML', 'LaTeX', 'Markdown', 'Word', 'PNG', 'PDF', or 'Typst' tables. The user interface is minimalist and easy to learn. The syntax is concise. 'HTML' tables can be customized using the flexible 'Bootstrap' framework, and 'LaTeX' code with the 'tabularray' package.
 Version: 0.19.0
 Imports: methods
 Depends: R (>= 4.1.0)
 Enhances: knitr
 Suggests: base64enc, broom, data.table (>= 1.15.2), estimatr, ggplot2,
         gh, glue, htmltools, litedown (>= 0.6), magrittr,
         marginaleffects, modelsummary, pandoc, pkgdown, png, quarto,
         Rdatasets, rmarkdown, rstudioapi, scales, stringi, tibble,
         tinysnapshot (>= 0.2.0), tinytest, tinytex, xfun (>= 0.51),
         webshot2
 URL: https://vincentarelbundock.github.io/tinytable/
 BugReports: https://github.com/vincentarelbundock/tinytable/issues
 Authors@R: c(
   person("Vincent", "Arel-Bundock",
   email = "vincent.arel-bundock@umontreal.ca",
   role = c("aut", "cre"),
   comment = c(ORCID = "0000-0003-2042-7063")))
 License: GPL (>= 3)
 Encoding: UTF-8
 Config/roxygen2/version: 8.0.0
 RoxygenNote: 7.3.3
 NeedsCompilation: no
 Packaged: 2026-09-16 14:50:17 UTC; vincent
 Author: Vincent Arel-Bundock [aut, cre] (ORCID:
     <https://orcid.org/0000-0003-2042-7063>)
 Maintainer: Vincent Arel-Bundock <vincent.arel-bundock@umontreal.ca>
 Repository: CRAN
 Date/Publication: 2026-09-16 15:50:02 UTC
Source:
 https://CRAN.R-project.org/package=tinytable

Files: *
Copyright: 2022 - 2026  Vincent Arel-Bundock
License: GPL-3+

Files: R/format_vector_escape.R
Comment: The LaTeX character escaping table is adapted from the gt package (https://github.com/rstudio/gt/)
Copyright: 2020-2026 Posit Software PBC
License: MIT

Files: R/print.R
Comment: The html_preserve() and htmltools_browsable() helpers are adapted from the htmltools package (https://github.com/rstudio/htmltools)
Copyright: 2014-2026 Posit Software PBC
License: GPL-3+

Files:
 inst/tabulator.scss
 inst/tabulator_tinytable.scss
 inst/tabulator_tinytable.css
 inst/tabulator_tinytable.min.css
 inst/tabulator_tinytable*.map
Comment:  These stylesheets are adapted from the SCSS sources of Tabulator (https://github.com/olifolkerd/tabulator)
Copyright: 2015-2026  Oli Folkerd
License: MIT

Files: debian/* 
Copyright: 2026  Dirk Eddelbuettel <edd@debian.org>
License: GPL-2+

License: GPL-2+
 On a Debian GNU/Linux system, the GPL license (version 2) is
 included in the file /usr/share/common-licenses/GPL-2.

License: GPL-3+
 On a Debian GNU/Linux system, the GPL license (version 3) is
 included in the file /usr/share/common-licenses/GPL-3.

License: MIT
 Copyright 2018 gt authors
 .
 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 4 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 7 days ago.

Proposes a replacement debian/watch: debian/watch in version 5 format

Report◂

DFSG NEW review for r-cran-tinytable version 0.19-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: Yes
  • Packaging is of good quality: Yes
  • Issues: 0 blocker, 0 important, 4 minor
  • debian/watch: old format (version 4)
  • debian/copyright: machine-readable
  • Scan before the review: 3 found

Licensing

Upstream is GPL (>= 3) and debian/copyright is DEP-5, with a Files: * GPL-3+ stanza plus stanzas for exactly the three third-party adaptations the sources declare: gt's LaTeX escape table (MIT, R/format_vector_escape.R:13), two htmltools helpers (R/print.R:26,219) and Tabulator's SCSS/CSS (MIT, inst/tabulator*). MIT and GPL-3 texts are reproduced or referenced to /usr/share/common-licenses; no non-free terms, no unlicensed file and no unshipped source was found. One inaccuracy: the standalone MIT paragraph still opens with gt's Copyright 2018 gt authors line, which then also reads as the licence text of the Tabulator stylesheets.

Packaging

Clean dh-r packaging: dh $@ --buildsystem R, debhelper 13, 3.0 (quilt) with no patches, Architecture: all, ${R:Depends}, salsa Vcs-*, an ITP closure and a satisfied Build-Depends (r-base-dev 4.6.1-10, dh-r 20260707 in unstable). Two minor points remain: the Debian version 0.19-1 drops the trailing .0 of upstream 0.19.0, so it sorts below the upstream version it was built from, and nothing runs the shipped tinytest suite, neither at build (dh-r's R buildsystem has no test step) nor in autopkgtest (no debian/tests).

Issues

minor licensing 1. The standalone MIT paragraph carries gt's Copyright 2018 gt authors line, which then reads as the licence of the Tabulator stylesheets too ◂
  • Files: debian/copyright:87-96
  • Basis: checked, in the package or with a reference tool
  • Evidence: License: MIT / Copyright 2018 gt authors / . / Permission is hereby granted, ..., reused by Files: R/format_vector_escape.R (Copyright 2020-2026 Posit Software PBC) and by the Files: inst/tabulator*.scss|css|map stanza (Copyright 2015-2026 Oli Folkerd).
  • Problem: DEP-5 puts the licence text itself in the standalone License paragraph; prefixing it with one holder's copyright line makes the Tabulator stanza claim gt's copyright notice as part of its licence, which is inaccurate about who holds copyright in those stylesheets.
  • Fix: Drop the Copyright 2018 gt authors line from the MIT paragraph (both stanzas already give their own Copyright), leaving the bare MIT permission text.
minor packaging 2. Debian version 0.19-1 for upstream 0.19.0 drops the trailing .0, so it sorts below the upstream version it packages ◂
  • Files: debian/changelog:1, DESCRIPTION:6
  • Basis: checked, in the package or with a reference tool
  • Evidence: r-cran-tinytable (0.19-1) unstable; upstream Version: 0.19.0. Policy 5.6.12 makes the upstream_version usually ... the version number of the original ("upstream") package, and by the comparison algorithm given there 0.19 < 0.19.0 (the remaining part is empty against ".0", and the empty part sorts first).
  • Problem: The Debian package's upstream_version is not the upstream version: 0.19 sorts earlier than the 0.19.0 it was unpacked from, so a later, correctly-named 0.19.0-1 upload of the same sources reads as a new upstream version, and every comparison against upstream releases (uscan, cme, dh-update-R, rmadison-driven tooling) is off by that difference.
  • Fix: Use upstream_version 0.19.0 (changelog r-cran-tinytable (0.19.0-1)) and rename the orig tarball to r-cran-tinytable_0.19.0.orig.tar.gz.
minor packaging 3. No autopkgtest, and the shipped tinytest suite is never run: dh-r's R buildsystem has no test step ◂
  • Files: tests/tinytest.R:1, inst/tinytest/
  • Basis: checked, in the package or with a reference tool
  • Evidence: tinytest::test_package("tinytable") in tests/tinytest.R, with the suite in inst/tinytest/; there is no debian/tests/ and no Testsuite: field; /usr/share/perl5/Debian/Debhelper/Buildsystem/R.pm defines only check_auto_buildable, install and friends — no sub test — and Buildsystem.pm's default sub test does nothing for a non-generator buildsystem, so dh_auto_test is a no-op.
  • Problem: A new package with a full test suite gets no test coverage in the archive: the tests are neither run at build time nor by ci.debian.net, so a broken dependency or an R update that breaks tinytable would be found only by users.
  • Fix: Add debian/tests/control (Tests: tinytest, Depends: @, r-cran-tinytest, r-cran-tinysnapshot) with a tests/tinytest runner that calls tinytest::test_package("tinytable"), and Testsuite: autopkgtest in debian/control; or run the suite from an override_dh_auto_test with r-cran-tinytest in Build-Depends-Indep.
minor packaging 4. debian/watch is in the old version 4 format ◂
  • Files: debian/watch
  • Basis: found by the review tooling's own checks
  • Evidence: version=4
  • Problem: Version 5 is the current format of debian/watch.
  • Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.
Verified ◂
  • Prescan, minified code: inst/tabulator_tinytable.min.css is the minified build of inst/tabulator_tinytable.scss (named as its only source in inst/tabulator_tinytable.min.css.map's "sources") and matches the readable inst/tabulator_tinytable.css beside it; both are declared in the Tabulator (MIT, Oli Folkerd) stanza.
  • Prescan, archives: build/partial.rdb is the gzip-compressed help index that R CMD build generates from the shipped man/*.Rd (all 50 of which are roxygen output of the R/ sources), and R/sysdata.rda is upstream's bzip2-compressed serialized internal R data loaded automatically by R; both are R's own formats, regenerable with R, and covered by Files: * GPL-3+.
  • Prescan, copyright holders: dfgs-author-check found every holder named; independent greps for Copyright/(C)/©/SPDX-License-Identifier/Licensed under/Permission is hereby granted/GNU/Lesser/Apache/MPL/public domain/All rights reserved found no holder beyond Vincent Arel-Bundock, Posit Software PBC (gt, htmltools) and Oli Folkerd (Tabulator).
  • Adaptations in the tree are exactly the three debian/copyright declares: R/format_vector_escape.R:13-16 (gt, MIT), R/print.R:26 and :219 (htmltools, GPL-3/+), inst/tabulator.scss, inst/tabulator_tinytable.scss, .css, .min.css and the two .map files (Tabulator, MIT). No other adapted from/copied from/derived from marker exists.
  • inst/COPYRIGHTS declares LPPL-1.3c for man-roxygen/tabularray.R; that file is not in the tarball and no tabularray-derived text is shipped (inst/templates/tabularray.tex is a five-line tblr skeleton, and every man/*.Rd is generated from R/ sources), so nothing under LPPL is distributed and debian/copyright rightly does not mention it.
  • inst/tinytest/_tinysnapshot/*.{html,typ,tex,md,txt} are tinysnapshot fixtures generated by the test suite, not documentation or shipped program: they hold table output only. The https://cdn.jsdelivr.net script/link URLs in them and in inst/templates/{html,tabulator}.html are upstream's design for generated HTML, which is what debian/r-cran-tinytable.lintian-overrides covers.
  • debian/ read in full (changelog, control, copyright, rules, watch aside, source/format, lintian-overrides); no patches, no maintainer scripts, no debian/tests. ${misc:Depends}/${R:Depends} are present, so compat 13 is covered.
  • Dependencies checked with apt-cache: r-base-dev 4.6.1-10 and dh-r 20260707 exist in unstable (satisfying r-base-dev (>= 4.6.1) and dh-r), and r-cran-tinytest 1.4.3-1 exists for Suggests. Standards-Version 4.7.4 matches the reviewing system's Policy 4.7.4.x.
  • Coverage: every file of debian/ read; R/ (79 files) and inst/ (CSS/SCSS/JS/templates) searched and heads read; all man/*.Rd provenance lines read; DESCRIPTION, README.md, NEWS.md, NAMESPACE and the .dsc inspected. Not a single file of .pc/ or debian/cargo-checksum.json was read.
  • uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 0.19.0, packaged 0.19), which is not a fault of the package.
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-2, GPL-3).
Not confirmed ◂
  • The interior of R/sysdata.rda and build/partial.rdb was not inspected (binary R serializations); their names, position and the absence of any sysdata generator or reference in R/ are all that could be checked.
Proposed: debian/watch in version 5 format ◂

debian/watch is in an old format. This is the conversion made by uscan --update-watchfile, which has not been run against the upstream site: some defaults differ in version 5, so test it with uscan --report before use.

Version: 5

Source: https://cloud.r-project.org/src/contrib/
Matching-Pattern: tinytable_([-\d\.]*)\.tar\.gz

Uploader's response to the LLM review

The uploader was emailed about the review 7 days ago.

Review Information

accepted — allocated to mechtilde 7 hours ago, started 7 hours ago, completed 7 hours ago.

Final Comment

Superseded by review of later version

Other Reviews of this Package

VersionHashAllocatedCompletedReviewerStatusDetails
0.19-2 7ce703e0… 2026-11-07 19:27 2026-11-07 19:28 mechtilde accepted VIEW
0.19-1 90734db2… 2026-10-30 21:20 2026-10-30 21:20 dfsg-uploader rejected VIEW

Back to Dashboard | View all reviews for this package