Review: r-cran-tinytable 0.19-2
Package Information
| Description | GNU R package for creation of highly customized tables This simple and dependency-free package converts data frames to 'HTML', 'LaTeX', 'Markdown', 'Word', 'PNG', 'PDF', or 'Typst' tables. The user interface is minimalist and easy to learn. The syntax is concise. 'HTML' tables can be customized using the flexible 'Bootstrap' framework, and 'LaTeX' code with the 'tabularray' package. |
|---|---|
| Maintainer | Dirk Eddelbuettel <edd@debian.org> |
| Changed By | Dirk Eddelbuettel <edd@debian.org> |
| Sponsor | edd@debian.org |
| Distribution | unstable |
| Architecture | all |
| VCS | git: https://salsa.debian.org/edd/r-cran-tinytable.git (browse) |
| Tracker | https://tracker.debian.org/pkg/r-cran-tinytable |
| Uploaded | 7 days ago |
| Supersedes | 0.19-1 |
New Package Report
.changes
| Date | Sat, 31 Oct 2026 11:46:21 -0500 |
|---|---|
| Source | r-cran-tinytable |
| Version | 0.19-2 |
| Changed-By | Dirk Eddelbuettel <edd@debian.org> |
| Architecture | source all |
| Distribution | unstable |
Changelog
r-cran-tinytable (0.19-2) unstable; urgency=medium . * debian/copyright: Refined based on upstream and review comments
.dsc
| Section | gnu-r |
|---|---|
| Priority | optional |
| Component | main |
| Package-List | r-cran-tinytable deb gnu-r optional arch=all |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: tinytable
Comment:
This is the Debian GNU/Linux r-cran-tinytable package of tinytable. The
tinytable package creates tables in various formats, and was written by
Vincent Arel-Bundock.Søren Højsgaard and
.
This package was created by Dirk Eddelbuettel <edd@debian.org>.
.
The package was renamed from its upstream name 'tinytable' to
'r-cran-tinytable' to fit the pattern of CRAN (and non-CRAN) packages
for R.
.
For reference, the upstream DESCRIPTION file is included below:
.
Package: tinytable
Type: Package
Title: Simple and Configurable Tables in 'HTML', 'LaTeX', 'Markdown',
'Word', 'PNG', 'PDF', and 'Typst' Formats
Description: Create highly customized tables with this simple and dependency-free package. Data frames can be converted to 'HTML', 'LaTeX', 'Markdown', 'Word', 'PNG', 'PDF', or 'Typst' tables. The user interface is minimalist and easy to learn. The syntax is concise. 'HTML' tables can be customized using the flexible 'Bootstrap' framework, and 'LaTeX' code with the 'tabularray' package.
Version: 0.19.0
Imports: methods
Depends: R (>= 4.1.0)
Enhances: knitr
Suggests: base64enc, broom, data.table (>= 1.15.2), estimatr, ggplot2,
gh, glue, htmltools, litedown (>= 0.6), magrittr,
marginaleffects, modelsummary, pandoc, pkgdown, png, quarto,
Rdatasets, rmarkdown, rstudioapi, scales, stringi, tibble,
tinysnapshot (>= 0.2.0), tinytest, tinytex, xfun (>= 0.51),
webshot2
URL: https://vincentarelbundock.github.io/tinytable/
BugReports: https://github.com/vincentarelbundock/tinytable/issues
Authors@R: c(
person("Vincent", "Arel-Bundock",
email = "vincent.arel-bundock@umontreal.ca",
role = c("aut", "cre"),
comment = c(ORCID = "0000-0003-2042-7063")))
License: GPL (>= 3)
Encoding: UTF-8
Config/roxygen2/version: 8.0.0
RoxygenNote: 7.3.3
NeedsCompilation: no
Packaged: 2026-09-16 14:50:17 UTC; vincent
Author: Vincent Arel-Bundock [aut, cre] (ORCID:
<https://orcid.org/0000-0003-2042-7063>)
Maintainer: Vincent Arel-Bundock <vincent.arel-bundock@umontreal.ca>
Repository: CRAN
Date/Publication: 2026-09-16 15:50:02 UTC
Source:
https://CRAN.R-project.org/package=tinytable
Files: *
Copyright: 2022 - 2026 Vincent Arel-Bundock
License: GPL-3+
Files: R/format_vector_escape.R
Comment: The LaTeX character escaping table is adapted from the gt package (https://github.com/rstudio/gt/)
Copyright: 2020-2026 Posit Software PBC
License: MIT
Files: R/print.R
Comment: The html_preserve() and htmltools_browsable() helpers are adapted from the htmltools package (https://github.com/rstudio/htmltools)
Copyright: 2014-2026 Posit Software PBC
License: GPL-3+
Files:
inst/tabulator.scss
inst/tabulator_tinytable.scss
inst/tabulator_tinytable.css
inst/tabulator_tinytable.min.css
inst/tabulator_tinytable*.map
Comment: These stylesheets are adapted from the SCSS sources of Tabulator (https://github.com/olifolkerd/tabulator)
Copyright: 2015-2026 Oli Folkerd
License: MIT
Files: debian/*
Copyright: 2026 Dirk Eddelbuettel <edd@debian.org>
License: GPL-2+
License: GPL-2+
On a Debian GNU/Linux system, the GPL license (version 2) is
included in the file /usr/share/common-licenses/GPL-2.
License: GPL-3+
On a Debian GNU/Linux system, the GPL license (version 3) is
included in the file /usr/share/common-licenses/GPL-3.
License: MIT
Copyright 2018 gt authors
.
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
.
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
DFSG Assistant LLM REVIEW 0 blocker, 0 important, 3 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 7 days ago.
Proposes a replacement debian/watch:
debian/watch in version 5 format
Report
DFSG NEW review for r-cran-tinytable version 0.19-2
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: Yes - Packaging is of good quality: Yes
- Issues: 0 blocker, 0 important, 3 minor
- debian/watch: old format (version 4)
- debian/copyright: machine-readable
- Scan before the review: 3 found
Licensing
The tree is free and DFSG-compliant. Upstream is GPL-3+ (License: GPL (>= 3) in DESCRIPTION); the third-party parts are the LaTeX escaping table from gt (MIT, R/format_vector_escape.R:12-15), two helpers from htmltools (GPL-3+, R/print.R:26,219) and the Tabulator SCSS/CSS stylesheets (MIT), all compatible with GPL-3+ and all carried in debian/copyright. debian/copyright is DEP-5, covers every file through Files: * plus the three specific stanzas, reproduces the MIT text, and gives Debian's own files GPL-2+ under debian/*. No non-commercial, no-modification or field-of-use wording occurs anywhere in the tree. The one loose end is an upstream notice in inst/COPYRIGHTS crediting LPPL-1.3c tabularray text that is not in the tarball (reported as minor).
Packaging
Conventional, sound dh-r packaging: one Architecture: all binary, debhelper compat 13 with a plain dh $@ --buildsystem R, all build dependencies present in unstable (debhelper-compat, dh-r, r-base-dev), both substvars the package needs (${misc:Depends}, ${R:Depends}) named and produced, Standards-Version 4.7.4 against Policy 4.7.4.1, quilt format with no patches (none needed), sane changelog, Homepage and Vcs fields. Only the unnecessarily high r-base-dev (>= 4.6.1) floor is worth changing. There is no autopkgtest, but the suite's snapshot tests need r-cran-tinysnapshot, which the archive does not have, so little would run anyway.
Issues
minor licensing 1. inst/COPYRIGHTS credits LPPL-1.3c material by Jianrui Lyu that debian/copyright does not mention and that the tarball does not contain ◂
- Files:
inst/COPYRIGHTS:5-9,debian/copyright - Basis: checked, in the package or with a reference tool
- Evidence:
The man-roxygen/tabularray.R file adapts portions of the tabularray.tex file, distributed as part of the tabularray package for LaTeX. ... 2021–2023 Jianrui Lyu / The LATEX Project Public License 1.3c.debian/copyrighthas stanzas only for GPL-3+, MIT (gt), GPL-3+ (htmltools) and MIT (Tabulator); noJianrui Lyuand no LPPL text. Noman-roxygen/directory exists in the tree, and upstream's ownMD5manifest (457 entries) lists no such path; a grep ofR/,man/andinst/forLPPL,Lyuandtabularray.texfinds only this notice. - Problem: The package ships a notice asserting that it contains tabularray-derived text held by Jianrui Lyu under LPPL-1.3c, which
debian/copyrightdoes not describe. Either that material does ship (adapted documentation would end up inman/*.Rd, whose sources are inR/) anddebian/copyrightis missing both the holder and the licence — LPPL-1.3c is not in/usr/share/common-licenses, so its text would have to be reproduced — or the notice is stale and misleading about the licensing of the package. - Fix: Ask upstream whether any tabularray-derived text survives in the shipped tree. If it does, add a
Files:stanza withCopyright: 2021-2023 Jianrui LyuandLicense: LPPL-1.3cplus the full LPPL text; if it does not, haveinst/COPYRIGHTScorrected upstream (or note indebian/copyrightthat the file it names is not distributed).
minor packaging 2. Build-Depends r-base-dev (>= 4.6.1) is stricter than the package needs, blocking builds against older r-base ◂
- Files:
debian/control:5,DESCRIPTION:7 - Basis: checked, in the package or with a reference tool
- Evidence:
Build-Depends: debhelper-compat (= 13), r-base-dev (>= 4.6.1), dh-ragainstDepends: R (>= 4.1.0)in DESCRIPTION.apt-cache show r-base-devgives 4.6.1-10 as the current unstable version. - Problem: Nothing in the package states a requirement above R 4.1.0, and DESCRIPTION sets the R version the binary will demand; the 4.6.1 floor therefore buys nothing and only prevents building where r-base is older (a backport to stable, or an experimental/testing mix). It is an over-tight build dependency of the kind Policy 7.1 asks to avoid.
- Fix: Drop the version constraint, or lower it to the R version the package actually needs.
minor packaging 3. debian/watch is in the old version 4 format ◂
- Files:
debian/watch - Basis: found by the review tooling's own checks
- Evidence:
version=4 - Problem: Version 5 is the current format of
debian/watch. - Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.
Verified ◂
- Prescan, minified code:
inst/tabulator_tinytable.min.cssis the compiled form ofinst/tabulator_tinytable.scss, which sits beside it, andinst/tabulator_tinytable.min.css.mapnames that SCSS as its source, so the preferred form for modification is present; the stylesheets are covered by the MIT stanza forinst/tabulator*. - Prescan, compressed file:
R/sysdata.rdais the package's own internal R data (objects such aslatex_colors, the LaTeX/xcolor colour name/value table documented atR/style_tt.R:558and used byR/colors.R); it is the source form of those constants, contains no executable code, and upstream ships no generator script, as is ordinary for CRAN packages. - Prescan, compressed file:
build/partial.rdbis the lazy-load databaseR CMD buildwrites for a package'sdata/directory. This package has nodata/directory and upstream'sMD5lists nodata/entries, so the file corresponds to no source that is missing from the package; it is a data artifact, not built program code, and is not Debian's doing. - Prescan, copyright holders: a tree-wide grep for
Copyright,(C),©,SPDX-License-Identifier,Licensed under,Permission is hereby granted,GNU General/Lesser,Apache License,Mozilla Public,public domainandAll rights reservedreturns notices only ininst/COPYRIGHTS(Vincent Arel-Bundock),R/format_vector_escape.R:13-16(gt, MIT),R/print.R:26,219(htmltools, GPL-3), plus thedebian/files; the first two third-party notices are indebian/copyright, the htmltools one is in theFiles: R/print.Rstanza. debian/copyrightis DEP-5 withFormat,Upstream-Name,Source,Files: *(GPL-3+), three specific stanzas (gt MIT, htmltools GPL-3+, Tabulator MIT) anddebian/*GPL-2+; the later stanzas correctly overrideFiles: *for the files they name, and the MIT notice is reproduced in full.- Read in full:
debian/control,debian/rules,debian/changelog,debian/copyright,debian/source/format,debian/r-cran-tinytable.lintian-overrides,debian/watch(not reviewed).debian/contains nothing else (nopatches/,tests/,upstream/,gbp.conf, maintainer scripts or install files), andsource/formatis3.0 (quilt)with no series to apply. - Standards-Version 4.7.4 against Policy 4.7.4.1: first two components equal, so not an issue.
- Build-Depends are all satisfiable in unstable:
debhelper-compat(dh 13),dh-r20260707,r-base-dev4.6.1-10;${R:Depends}is written by dh-r's R buildsystem (/usr/share/perl5/Debian/Debhelper/Buildsystem/R.pm:354) and is named inDepends, as is${misc:Depends}. tests/tinytest.Rruns the shipped tinytest suite; there is nodebian/tests/, so nothing runs it in the archive, and the snapshot tests callusing("tinysnapshot")forr-cran-tinysnapshot, which is not in the archive, so an autopkgtest could add only a little coverage today.debian/r-cran-tinytable.lintian-overridessuppressesprivacy-breach-genericpackage-wide for the CDN references in the shippedinst/tinytest/_tinysnapshot/*.htmlfixtures (e.g.escape-simple.html:13,35); the reason is stated in the file, and no third-party JavaScript or CSS is vendored in those fixtures.man/figures/readme_01.pngandman/figures/readme_02.pngare renders of tinytable's own tables used byREADME.md; no other images or fonts are shipped.README.mdlinks aman/figures/gallery/image that is not in the tarball (website only, not an installed file).- No non-free wording anywhere in the tree (
non-commercial,no modification,field of use,CC BY-NC/ND,Good, not Evilall absent). - uscan found upstream releases with
debian/watch; a newer upstream version is available (upstream0.19.0, packaged0.19), which is not a fault of the package. - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (GPL-2,GPL-3).
Not confirmed ◂
- Whether any tabularray-derived (LPPL-1.3c) text ships at all: the file
inst/COPYRIGHTSnames,man-roxygen/tabularray.R, is not in the tarball, and no shipped file carries an LPPL notice, so the answer needs upstream's repository. - The contents of the two binary files were not inspected (opening binary files was out of scope):
R/sysdata.rdaandbuild/partial.rdbwere judged by their location, by upstream'sMD5manifest and by the R code that uses them.
Proposed: debian/watch in version 5 format ◂
debian/watch is in an old format. This is the conversion made by uscan --update-watchfile, which has not been run against the upstream site: some defaults differ in version 5, so test it with uscan --report before use.
Version: 5
Source: https://cloud.r-project.org/src/contrib/
Matching-Pattern: tinytable_([-\d\.]*)\.tar\.gz
Uploader's response to the LLM review
There are (per the parallel email) three issues. I will take them on in turn.
-
"[licensing] "nst/COPYRIGHTS credits LPPL-1.3c": I communicated about this with upstream (who happens to be a friend and collaborator). The
inst/COPYRIGHTSdoes indeed refer to a file in the source distribution at the package upstream repo etc but it is not part of the CRAN upload. So this is a non-issue. Upstream has also rewritten / expanded theinst/COPYRIGHT(in part based on the good feedback of the first review here). -
"[packaging] Build-Depends r-base-dev (>= 4.6.1)" I am the maintainer for the R package (src:r-base) and hence a good handle on this, and do this on purpose for all my packages in Debian. It has never created an issue. So I consider this to be a fair question but ultimately a false positive. Another non-issue.
-
"[packaging] debian/watch is in the old version 4 format: Yes. As are all my other packages. I will update them to version 5 when this works on all platforms I work on packages; when I first attempted this earlier in the year "all hell broke loose" (e.g. on Ubuntu installations also having the repo checked out). Another non-issue.
In sum, I think the package is ready.
— Dirk Eddelbuettel (edd), 7 days ago
Review Information
accepted — allocated to mechtilde 7 hours ago, started 7 hours ago, completed 7 hours ago.