DFSG NEW Queue

DFSG, Licensing & New Packages Team

umap-learn 0.6.0+dfsg-1

Package Information

DescriptionUniform Manifold Approximation and Projection

Uniform Manifold Approximation and Projection (UMAP) is a dimension reduction technique that can be used for visualisation similarly to t- SNE, but also for general non-linear dimension reduction. The algorithm is founded on three assumptions about the data:

1. The data is uniformly distributed on a Riemannian manifold; 2. The Riemannian metric is locally constant (or can be approximated as such); 3. The manifold is locally connected.

From these assumptions it is possible to model the manifold with a fuzzy topological structure. The embedding is found by searching for a low dimensional projection of the data that has the closest possible equivalent fuzzy topological structure.

MaintainerDebian Med Packaging Team <debian-med-packaging@lists.alioth.debian.org>
Changed ByAndreas Tille <tille@debian.org>
Sponsortille@debian.org
Distributionunstable
Architectureall
VCSgit: https://salsa.debian.org/med-team/umap-learn.git (browse)
Closes#980509
Popcon Installs24
Binary NEWYes (new binary packages of a source already in sid)
Trackerhttps://tracker.debian.org/pkg/umap-learn
Uploaded1 hour ago

New Package Report

.changes◂
Changed-ByAndreas Tille <tille@debian.org>
Architecturesource all
Distributionunstable
DateTue, 10 Nov 2026 19:50:10 +0100
Sourceumap-learn
Version0.6.0+dfsg-1
Changelog◂ 
umap-learn (0.6.0+dfsg-1) unstable; urgency=medium
 .
   * New upstream version
   * d/watch:
      - Version=5
      - Do not report rc candidates
   * Rename binary package to python3-umap-learn
     Closes: #980509
   * debputy lint --auto-fix (routine-update)
   * Install compatibility regression fixture as package data
.dsc◂
Priorityoptional
Componentmain
Package-Listpython3-umap-learn deb python optional arch=all
Sectionpython
debian/copyright◂ 
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: umap
Source: https://github.com/lmcinnes/umap/releases
Files-Excluded: doc
                notebooks

Files: *
Copyright: 2017-2020 Leland McInnes
License: BSD-3-Clause

Files: debian/*
Copyright: 2020 Andreas Tille <tille@debian.org>
License: BSD-3-Clause

License: BSD-3-Clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
  * Redistributions of source code must retain the above copyright notice, this
    list of conditions and the following disclaimer.
 .
  * Redistributions in binary form must reproduce the above copyright notice,
    this list of conditions and the following disclaimer in the documentation
    and/or other materials provided with the distribution.
 .
  * Neither the name of the copyright holder nor the names of its
    contributors may be used to endorse or promote products derived from
    this software without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
 FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
 CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

DFSG Assistant LLM REVIEW 1 blocker, 0 important, 4 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 0 hours ago.

Report◂

DFSG NEW review for umap-learn version 0.6.0+dfsg-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: No
  • Packaging is of good quality: Yes
  • Issues: 1 blocker, 0 important, 4 minor
  • debian/watch: version 5
  • debian/copyright: machine-readable
  • Scan before the review: 2 found

Licensing

Every file in the tree is under a free licence, so there is no DFSG violation: the code is BSD-3-Clause (LICENSE.txt plus the # License: BSD 3 clause headers in umap/distances.py, umap/sparse.py, umap/umap_.py, umap/utils.py agree), the two functions adapted from TensorFlow Probability are Apache-2.0, and the adapted code of conduct is CC BY 4.0. debian/copyright, however, is not accurate: its Files: * stanza declares every upstream file to be BSD-3-Clause by Leland McInnes, which is wrong for umap/parametric_umap.py and for CODE_OF_CONDUCT.md, and its Files: debian/* stanza stops at Andreas Tille's 2020 work although the patches and tests there were written by others. The file is otherwise well formed DEP-5 with the BSD-3-Clause text and the +dfsg exclusions of doc/ and notebooks/ recorded correctly.

Packaging

The packaging is competent: debhelper compat 14 with dh-sequence-python3 and pybuild-plugin-pyproject, the upstream suite run through pybuild at build time, an autopkgtest that runs three of the shipped examples under xvfb, DEP-5 copyright, Vcs-* fields, current Standards-Version, and the rename to python3-umap-learn handled with Provides/Breaks/Replaces. dh_python3 translates the dist-info Requires-Dist entries, so the hand-written Depends does not need to list python3-pynndescent or python3-tqdm; both are in Build-Depends and installed when the build runs. What remains are nits: an unnecessary hard dependency on python3-pandas and a dead debian/Example/umap_example.py that is never installed.

Issues

blocker licensing 1. debian/copyright declares umap/parametric_umap.py BSD-3-Clause although it contains code adapted from TensorFlow Probability (Apache-2.0) ◂
  • Files: umap/parametric_umap.py:1049-1120 (covariance(), correlation()); debian/copyright:7-9 (the Files: * stanza)
  • Basis: checked, in the package or with a reference tool
  • Evidence: def covariance(x, y=None, keepdims=False): followed by """Adapted from TF Probability.""", and the same tfp-shaped code in correlation(). debian/copyright has only Files: * / Copyright: 2017-2020 Leland McInnes / License: BSD-3-Clause for the whole upstream tree.
  • Problem: TensorFlow Probability is Apache-2.0: section 4(a) requires shipping its licence and 4(b) keeping its notices in a derivative work. A BSD-3 grant from the umap author does not relicense the adapted portion, and the copyright file names neither the TensorFlow Probability authors nor Apache-2.0, so it does not describe a file that the binary package ships. The two licences are compatible, so nothing here is non-free; the fault is the missing attribution and licence in debian/copyright.
  • Fix: Add a stanza Files: umap/parametric_umap.py with the TensorFlow Probability copyright and License: Apache-2.0, plus a stand-alone License: Apache-2.0 paragraph (the text is in /usr/share/common-licenses/Apache-2.0, so a pointer suffices), noting that the rest of the file is the umap authors' BSD-3-Clause work.
minor licensing 2. debian/copyright does not record that CODE_OF_CONDUCT.md is adapted from the Contributor Covenant, which is CC BY 4.0 ◂
  • Files: CODE_OF_CONDUCT.md:49-52; debian/copyright:7-9
  • Basis: checked, in the package or with a reference tool
  • Evidence: CODE_OF_CONDUCT.md ends with This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4; the only stanza that matches it is Files: * / Copyright: 2017-2020 Leland McInnes / License: BSD-3-Clause.
  • Problem: The Contributor Covenant is published under CC BY 4.0, which demands attribution and does not let the text be relicensed under BSD-3; the file therefore carries a third-party licence that debian/copyright denies. The file is not installed in python3-umap-learn, which limits the impact to the source package.
  • Fix: Add Files: CODE_OF_CONDUCT.md with the Contributor Covenant copyright and License: CC-BY-4.0, and the full CC BY 4.0 text as a stand-alone paragraph since it is not in /usr/share/common-licenses.
minor licensing 3. Files: debian/* names only Andreas Tille, omitting Michael R. Crusoe and Nilesh Patra who wrote the patches and tests in debian/ ◂
  • Files: debian/copyright:11-13; debian/patches/install-tests:1; debian/patches/disable-and-fix-incompatible-tests.patch:1; debian/patches/fix-example.patch:1
  • Basis: checked, in the package or with a reference tool
  • Evidence: From: Michael R. Crusoe <crusoe@debian.org> (install-tests), Author: Nilesh Patra <npatra974@gmail.com> (disable-and-fix-incompatible-tests.patch), From: Nilesh Patra <nilesh@nileshpatra.info> (fix-example.patch); debian/copyright says Copyright: 2020 Andreas Tille <tille@debian.org> for all of debian/.
  • Problem: The debian/* stanza misstates the authorship of the packaging: most of the current patch set and the autopkgtest were written by others, and the changelog shows Michael R. Crusoe's 2025-2026 uploads.
  • Fix: List the other holders with their years, e.g. 2020 Andreas Tille, 2020-2021 Nilesh Patra, 2025-2026 Michael R. Crusoe, or 2020 Andreas Tille and others.
minor packaging 4. python3-umap-learn Depends on python3-pandas although pandas is only used by the optional umap.plot module ◂
  • Files: debian/control:29-33 (binary Depends); umap/plot.py:5-7 and 24-34
  • Basis: checked, in the package or with a reference tool
  • Evidence: python3-pandas, in Package: python3-umap-learn's Depends; umap/plot.py imports it inside the guarded block try: import pandas as pd ... except ImportError: which ends in raise ImportError("umap.plot requires pandas matplotlib datashader bokeh holoviews scikit-image and colorcet ..."); upstream pyproject.toml lists pandas only under [project.optional-dependencies] plot.
  • Problem: No module of the package needs pandas to be imported or used: umap.plot cannot function anyway without datashader/bokeh/holoviews/colorcet, none of which are packaged or depended on. The hard dependency only adds a large install for every user.
  • Fix: Drop python3-pandas from Depends; a Suggests (or Recommends once the plotting stack is packaged) is the right strength.
minor packaging 5. debian/Example/umap_example.py is dead: its only reference in debian/examples is commented out, so it is never installed ◂
  • Files: debian/Example/umap_example.py; debian/examples:1; debian/tests/run-examples:20
  • Basis: checked, in the package or with a reference tool
  • Evidence: debian/examples holds # debian/Example/* on its first line and examples/* on the second; debhelper's filedoublearray skips # lines (next if /^#/; in Dh_Lib.pm), so only the upstream examples/ tree is installed. debian/tests/run-examples likewise has # python3 umap_example.py.
  • Problem: An installable-looking example that is never installed, and a stale script (from umap import *) that misleads anyone reading debian/ into thinking it ships.
  • Fix: Delete debian/Example/ and the commented line in debian/examples, or install the file deliberately.
Verified ◂
  • debian/copyright is DEP-5 1.0 with Files: *, Files: debian/* and one stand-alone BSD-3-Clause paragraph whose text matches LICENSE.txt; Files-Excluded doc notebooks matches the tree (neither directory is present).
  • Whole-tree grep for Copyright, (C), (c), ©, SPDX-License-Identifier, All rights reserved, public domain, BSD, MIT, Apache, GPL found notices only in LICENSE.txt and debian/copyright; the only per-file licence marks are # License: BSD 3 clause in umap/distances.py, umap/sparse.py, umap/umap_.py and umap/utils.py, consistent with the copyright file. No other holder appears in any file.
  • No non-free wording anywhere: grep for non-commercial, no-modification, not evil, research-only/academic-only use found nothing.
  • umap/tests/data/compat_0_5_final.npz (the zip archive the scan flagged) is a fixture generated by the shipped umap/tests/data/make_compat_fixtures.py and read by umap/tests/test_compatibility_regression.py; its generator and consumer are in the package.
  • umap/tests/digits_embedding_42.npy (the unrecognised binary the scan flagged) is a NumPy array of embedding coordinates used as test data; no file in the tree references it, so it is an unused fixture rather than a build product with a missing source.
  • examples/digits/digits.html and examples/iris/iris.html are Bokeh exports of the adjacent digits.py and iris.py examples and are the two files covered by the override in debian/source/lintian-overrides; they hold plot data and Bokeh embed boilerplate, not minified library code. images/*.png are the upstream README/paper figures; all of it is Leland McInnes's own work under the project licence.
  • Build-Depends/Depends: python3-pynndescent and python3-tqdm are absent from the binary Depends but dh_python3 translates the dist-info Requires-Dist entries into ${python3:Depends} (man dh_python3, dependencies; DhPython/pydist.py resolves each name with dpkg -S '*python3/*/<name>-?*.*-info'), and both packages are installed at build time, so the binary package does get them. Nothing is missing.
  • All six patches are applied to the tree as shipped (test_densmap.py has trust >= 0.95, test_composite_models.py trust >= 0.80, test_plot.py @pytest.mark.xfail(run=False), test_parametric_umap.py except ModuleNotFoundError, pyproject.toml packages = ["umap", "umap.tests"] with "umap.tests" = ["data/*.npz"]), so none of them is obsolete.
  • Standards-Version 4.7.4 against Policy 4.7.4.1 (first two components match) is current; compat 14 is the recommended level; ${misc:Depends}/${python3:Depends} being written out is harmless at compat 14.
  • I read every file under debian/ except debian/watch, which is out of scope, and covered the whole upstream tree by glob plus the greps above; .pc/ and debian/cargo-checksum.json were left out.
  • uscan found the packaged version as the newest upstream release (upstream 0.6.0, packaged 0.6.0+dfsg).
Not confirmed ◂
  • Whether debian/tests/run-examples passes. It gunzip -r *s the whole installed examples directory; debian/examples' examples/* also installs the digits/ and iris/ subdirectories, whose .html files dh_compress leaves uncompressed (! -iname "*.htm*"), so gunzip is handed non-.gz files and set -e would abort the test on a warning-level exit. I had no way to run gunzip to settle it.
  • The repack's reason and completeness: only the +dfsg orig tarball is in the review directory, not upstream's original, so I could not see what else (if anything) the +dfsg repack removed or whether doc/ and notebooks/ had to go for licensing reasons.
  • Installed paths and compression were reasoned from dh_installexamples/dh_compress and Dh_Lib.pm behaviour, not from an unpacked binary package.
Proposed changes ◂

None.

Back to Dashboard | View all reviews for this package