DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: r-cran-tinytable 0.19-2

Package Information

DescriptionGNU R package for creation of highly customized tables

This simple and dependency-free package converts data frames to 'HTML', 'LaTeX', 'Markdown', 'Word', 'PNG', 'PDF', or 'Typst' tables. The user interface is minimalist and easy to learn. The syntax is concise. 'HTML' tables can be customized using the flexible 'Bootstrap' framework, and 'LaTeX' code with the 'tabularray' package.

MaintainerDirk Eddelbuettel <edd@debian.org>
Changed ByDirk Eddelbuettel <edd@debian.org>
Sponsoredd@debian.org
Distributionunstable
Architectureall
VCSgit: https://salsa.debian.org/edd/r-cran-tinytable.git (browse)
Trackerhttps://tracker.debian.org/pkg/r-cran-tinytable
Uploaded7 days ago
Supersedes0.19-1

New Package Report

.changes◂
Distributionunstable
DateSat, 31 Oct 2026 11:46:21 -0500
Sourcer-cran-tinytable
Version0.19-2
Changed-ByDirk Eddelbuettel <edd@debian.org>
Architecturesource all
Changelog◂
r-cran-tinytable (0.19-2) unstable; urgency=medium
 .
   * debian/copyright: Refined based on upstream and review comments
.dsc◂
Package-Listr-cran-tinytable deb gnu-r optional arch=all
Sectiongnu-r
Priorityoptional
Componentmain
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: tinytable
Comment:
 This is the Debian GNU/Linux r-cran-tinytable package of tinytable. The
 tinytable package creates tables in various formats, and was written by
 Vincent Arel-Bundock.Søren Højsgaard and
 .
 This package was created by Dirk Eddelbuettel <edd@debian.org>.
 .
 The package was renamed from its upstream name 'tinytable' to
 'r-cran-tinytable' to fit the pattern of CRAN (and non-CRAN) packages
 for R.
 .
 For reference, the upstream DESCRIPTION file is included below:
 .
 Package: tinytable
 Type: Package
 Title: Simple and Configurable Tables in 'HTML', 'LaTeX', 'Markdown',
         'Word', 'PNG', 'PDF', and 'Typst' Formats
 Description: Create highly customized tables with this simple and dependency-free package. Data frames can be converted to 'HTML', 'LaTeX', 'Markdown', 'Word', 'PNG', 'PDF', or 'Typst' tables. The user interface is minimalist and easy to learn. The syntax is concise. 'HTML' tables can be customized using the flexible 'Bootstrap' framework, and 'LaTeX' code with the 'tabularray' package.
 Version: 0.19.0
 Imports: methods
 Depends: R (>= 4.1.0)
 Enhances: knitr
 Suggests: base64enc, broom, data.table (>= 1.15.2), estimatr, ggplot2,
         gh, glue, htmltools, litedown (>= 0.6), magrittr,
         marginaleffects, modelsummary, pandoc, pkgdown, png, quarto,
         Rdatasets, rmarkdown, rstudioapi, scales, stringi, tibble,
         tinysnapshot (>= 0.2.0), tinytest, tinytex, xfun (>= 0.51),
         webshot2
 URL: https://vincentarelbundock.github.io/tinytable/
 BugReports: https://github.com/vincentarelbundock/tinytable/issues
 Authors@R: c(
   person("Vincent", "Arel-Bundock",
   email = "vincent.arel-bundock@umontreal.ca",
   role = c("aut", "cre"),
   comment = c(ORCID = "0000-0003-2042-7063")))
 License: GPL (>= 3)
 Encoding: UTF-8
 Config/roxygen2/version: 8.0.0
 RoxygenNote: 7.3.3
 NeedsCompilation: no
 Packaged: 2026-09-16 14:50:17 UTC; vincent
 Author: Vincent Arel-Bundock [aut, cre] (ORCID:
     <https://orcid.org/0000-0003-2042-7063>)
 Maintainer: Vincent Arel-Bundock <vincent.arel-bundock@umontreal.ca>
 Repository: CRAN
 Date/Publication: 2026-09-16 15:50:02 UTC
Source:
 https://CRAN.R-project.org/package=tinytable

Files: *
Copyright: 2022 - 2026  Vincent Arel-Bundock
License: GPL-3+

Files: R/format_vector_escape.R
Comment: The LaTeX character escaping table is adapted from the gt package (https://github.com/rstudio/gt/)
Copyright: 2020-2026 Posit Software PBC
License: MIT

Files: R/print.R
Comment: The html_preserve() and htmltools_browsable() helpers are adapted from the htmltools package (https://github.com/rstudio/htmltools)
Copyright: 2014-2026 Posit Software PBC
License: GPL-3+

Files:
 inst/tabulator.scss
 inst/tabulator_tinytable.scss
 inst/tabulator_tinytable.css
 inst/tabulator_tinytable.min.css
 inst/tabulator_tinytable*.map
Comment:  These stylesheets are adapted from the SCSS sources of Tabulator (https://github.com/olifolkerd/tabulator)
Copyright: 2015-2026  Oli Folkerd
License: MIT

Files: debian/* 
Copyright: 2026  Dirk Eddelbuettel <edd@debian.org>
License: GPL-2+

License: GPL-2+
 On a Debian GNU/Linux system, the GPL license (version 2) is
 included in the file /usr/share/common-licenses/GPL-2.

License: GPL-3+
 On a Debian GNU/Linux system, the GPL license (version 3) is
 included in the file /usr/share/common-licenses/GPL-3.

License: MIT
 Copyright 2018 gt authors
 .
 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 3 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 7 days ago.

Proposes a replacement debian/watch: debian/watch in version 5 format

Report◂

DFSG NEW review for r-cran-tinytable version 0.19-2

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: Yes
  • Packaging is of good quality: Yes
  • Issues: 0 blocker, 0 important, 3 minor
  • debian/watch: old format (version 4)
  • debian/copyright: machine-readable
  • Scan before the review: 3 found

Licensing

The tree is free and DFSG-compliant. Upstream is GPL-3+ (License: GPL (>= 3) in DESCRIPTION); the third-party parts are the LaTeX escaping table from gt (MIT, R/format_vector_escape.R:12-15), two helpers from htmltools (GPL-3+, R/print.R:26,219) and the Tabulator SCSS/CSS stylesheets (MIT), all compatible with GPL-3+ and all carried in debian/copyright. debian/copyright is DEP-5, covers every file through Files: * plus the three specific stanzas, reproduces the MIT text, and gives Debian's own files GPL-2+ under debian/*. No non-commercial, no-modification or field-of-use wording occurs anywhere in the tree. The one loose end is an upstream notice in inst/COPYRIGHTS crediting LPPL-1.3c tabularray text that is not in the tarball (reported as minor).

Packaging

Conventional, sound dh-r packaging: one Architecture: all binary, debhelper compat 13 with a plain dh $@ --buildsystem R, all build dependencies present in unstable (debhelper-compat, dh-r, r-base-dev), both substvars the package needs (${misc:Depends}, ${R:Depends}) named and produced, Standards-Version 4.7.4 against Policy 4.7.4.1, quilt format with no patches (none needed), sane changelog, Homepage and Vcs fields. Only the unnecessarily high r-base-dev (>= 4.6.1) floor is worth changing. There is no autopkgtest, but the suite's snapshot tests need r-cran-tinysnapshot, which the archive does not have, so little would run anyway.

Issues

minor licensing 1. inst/COPYRIGHTS credits LPPL-1.3c material by Jianrui Lyu that debian/copyright does not mention and that the tarball does not contain ◂
  • Files: inst/COPYRIGHTS:5-9, debian/copyright
  • Basis: checked, in the package or with a reference tool
  • Evidence: The man-roxygen/tabularray.R file adapts portions of the tabularray.tex file, distributed as part of the tabularray package for LaTeX. ... 2021–2023 Jianrui Lyu / The LATEX Project Public License 1.3c. debian/copyright has stanzas only for GPL-3+, MIT (gt), GPL-3+ (htmltools) and MIT (Tabulator); no Jianrui Lyu and no LPPL text. No man-roxygen/ directory exists in the tree, and upstream's own MD5 manifest (457 entries) lists no such path; a grep of R/, man/ and inst/ for LPPL, Lyu and tabularray.tex finds only this notice.
  • Problem: The package ships a notice asserting that it contains tabularray-derived text held by Jianrui Lyu under LPPL-1.3c, which debian/copyright does not describe. Either that material does ship (adapted documentation would end up in man/*.Rd, whose sources are in R/) and debian/copyright is missing both the holder and the licence — LPPL-1.3c is not in /usr/share/common-licenses, so its text would have to be reproduced — or the notice is stale and misleading about the licensing of the package.
  • Fix: Ask upstream whether any tabularray-derived text survives in the shipped tree. If it does, add a Files: stanza with Copyright: 2021-2023 Jianrui Lyu and License: LPPL-1.3c plus the full LPPL text; if it does not, have inst/COPYRIGHTS corrected upstream (or note in debian/copyright that the file it names is not distributed).
minor packaging 2. Build-Depends r-base-dev (>= 4.6.1) is stricter than the package needs, blocking builds against older r-base ◂
  • Files: debian/control:5, DESCRIPTION:7
  • Basis: checked, in the package or with a reference tool
  • Evidence: Build-Depends: debhelper-compat (= 13), r-base-dev (>= 4.6.1), dh-r against Depends: R (>= 4.1.0) in DESCRIPTION. apt-cache show r-base-dev gives 4.6.1-10 as the current unstable version.
  • Problem: Nothing in the package states a requirement above R 4.1.0, and DESCRIPTION sets the R version the binary will demand; the 4.6.1 floor therefore buys nothing and only prevents building where r-base is older (a backport to stable, or an experimental/testing mix). It is an over-tight build dependency of the kind Policy 7.1 asks to avoid.
  • Fix: Drop the version constraint, or lower it to the R version the package actually needs.
minor packaging 3. debian/watch is in the old version 4 format ◂
  • Files: debian/watch
  • Basis: found by the review tooling's own checks
  • Evidence: version=4
  • Problem: Version 5 is the current format of debian/watch.
  • Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.
Verified ◂
  • Prescan, minified code: inst/tabulator_tinytable.min.css is the compiled form of inst/tabulator_tinytable.scss, which sits beside it, and inst/tabulator_tinytable.min.css.map names that SCSS as its source, so the preferred form for modification is present; the stylesheets are covered by the MIT stanza for inst/tabulator*.
  • Prescan, compressed file: R/sysdata.rda is the package's own internal R data (objects such as latex_colors, the LaTeX/xcolor colour name/value table documented at R/style_tt.R:558 and used by R/colors.R); it is the source form of those constants, contains no executable code, and upstream ships no generator script, as is ordinary for CRAN packages.
  • Prescan, compressed file: build/partial.rdb is the lazy-load database R CMD build writes for a package's data/ directory. This package has no data/ directory and upstream's MD5 lists no data/ entries, so the file corresponds to no source that is missing from the package; it is a data artifact, not built program code, and is not Debian's doing.
  • Prescan, copyright holders: a tree-wide grep for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU General/Lesser, Apache License, Mozilla Public, public domain and All rights reserved returns notices only in inst/COPYRIGHTS (Vincent Arel-Bundock), R/format_vector_escape.R:13-16 (gt, MIT), R/print.R:26,219 (htmltools, GPL-3), plus the debian/ files; the first two third-party notices are in debian/copyright, the htmltools one is in the Files: R/print.R stanza.
  • debian/copyright is DEP-5 with Format, Upstream-Name, Source, Files: * (GPL-3+), three specific stanzas (gt MIT, htmltools GPL-3+, Tabulator MIT) and debian/* GPL-2+; the later stanzas correctly override Files: * for the files they name, and the MIT notice is reproduced in full.
  • Read in full: debian/control, debian/rules, debian/changelog, debian/copyright, debian/source/format, debian/r-cran-tinytable.lintian-overrides, debian/watch (not reviewed). debian/ contains nothing else (no patches/, tests/, upstream/, gbp.conf, maintainer scripts or install files), and source/format is 3.0 (quilt) with no series to apply.
  • Standards-Version 4.7.4 against Policy 4.7.4.1: first two components equal, so not an issue.
  • Build-Depends are all satisfiable in unstable: debhelper-compat (dh 13), dh-r 20260707, r-base-dev 4.6.1-10; ${R:Depends} is written by dh-r's R buildsystem (/usr/share/perl5/Debian/Debhelper/Buildsystem/R.pm:354) and is named in Depends, as is ${misc:Depends}.
  • tests/tinytest.R runs the shipped tinytest suite; there is no debian/tests/, so nothing runs it in the archive, and the snapshot tests call using("tinysnapshot") for r-cran-tinysnapshot, which is not in the archive, so an autopkgtest could add only a little coverage today.
  • debian/r-cran-tinytable.lintian-overrides suppresses privacy-breach-generic package-wide for the CDN references in the shipped inst/tinytest/_tinysnapshot/*.html fixtures (e.g. escape-simple.html:13,35); the reason is stated in the file, and no third-party JavaScript or CSS is vendored in those fixtures.
  • man/figures/readme_01.png and man/figures/readme_02.png are renders of tinytable's own tables used by README.md; no other images or fonts are shipped. README.md links a man/figures/gallery/ image that is not in the tarball (website only, not an installed file).
  • No non-free wording anywhere in the tree (non-commercial, no modification, field of use, CC BY-NC/ND, Good, not Evil all absent).
  • uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 0.19.0, packaged 0.19), which is not a fault of the package.
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-2, GPL-3).
Not confirmed ◂
  • Whether any tabularray-derived (LPPL-1.3c) text ships at all: the file inst/COPYRIGHTS names, man-roxygen/tabularray.R, is not in the tarball, and no shipped file carries an LPPL notice, so the answer needs upstream's repository.
  • The contents of the two binary files were not inspected (opening binary files was out of scope): R/sysdata.rda and build/partial.rdb were judged by their location, by upstream's MD5 manifest and by the R code that uses them.
Proposed: debian/watch in version 5 format ◂

debian/watch is in an old format. This is the conversion made by uscan --update-watchfile, which has not been run against the upstream site: some defaults differ in version 5, so test it with uscan --report before use.

Version: 5

Source: https://cloud.r-project.org/src/contrib/
Matching-Pattern: tinytable_([-\d\.]*)\.tar\.gz

Uploader's response to the LLM review

There are (per the parallel email) three issues. I will take them on in turn.

  1. "[licensing] "nst/COPYRIGHTS credits LPPL-1.3c": I communicated about this with upstream (who happens to be a friend and collaborator). The inst/COPYRIGHTS does indeed refer to a file in the source distribution at the package upstream repo etc but it is not part of the CRAN upload. So this is a non-issue. Upstream has also rewritten / expanded the inst/COPYRIGHT (in part based on the good feedback of the first review here).

  2. "[packaging] Build-Depends r-base-dev (>= 4.6.1)" I am the maintainer for the R package (src:r-base) and hence a good handle on this, and do this on purpose for all my packages in Debian. It has never created an issue. So I consider this to be a fair question but ultimately a false positive. Another non-issue.

  3. "[packaging] debian/watch is in the old version 4 format: Yes. As are all my other packages. I will update them to version 5 when this works on all platforms I work on packages; when I first attempted this earlier in the year "all hell broke loose" (e.g. on Ubuntu installations also having the repo checked out). Another non-issue.

In sum, I think the package is ready.

— Dirk Eddelbuettel (edd), 7 days ago

Review Information

accepted — allocated to mechtilde 7 hours ago, started 7 hours ago, completed 7 hours ago.

Final Comment

Other Reviews of this Package

VersionHashAllocatedCompletedReviewerStatusDetails
0.19-1 90734db2… 2026-10-30 21:20 2026-10-30 21:20 dfsg-uploader rejected VIEW
0.19-1 e314780b… 2026-11-07 19:28 2026-11-07 19:28 mechtilde accepted VIEW

Back to Dashboard | View all reviews for this package