* Package name    : node-cssfilter
  Version         : 0.0.11
  Upstream Author : Zongmin Lei <leizongmin@gmail.com>
* URL             : https://github.com/leizongmin/js-css-filter
* License         : MIT
  Programming Lang: JavaScript
  Description     : CSS declaration sanitizer with configurable allowlist

  This library parses CSS property declarations, removes comments and filters
  properties and values against a default or custom allowlist.
  .
  Rules can allow or reject individual properties, match values with regular
  expressions or validate them with callback functions. Additional callbacks
  can replace the output for allowed or rejected declarations and customize
  value filtering.

This library is a dependancy of Home Assistant, the Python smart home platform.
I plan to maintain it as part of the Home Assistant team.

Also this library is required for the xss node package (RFP: #892826).

This is an automated message from the Debian DFSG, Licensing & New
Packages Team.

The Debian NEW review of node-cssfilter 0.0.11-1 has been completed.

Decision: ACCEPTED
Reviewer: Andrew McMillan

Review comment:

Hi,

Some pedantic issues found during the review.  I'm not sure if the first one is an actual problem, or a misdiagnosis. Similarly with the third, and the second is very minor.

1. Installed package has no Node.js entry point, so `require('cssfilter')` fails

 - Files: `debian/node-cssfilter.install`, `package.json`, `test/test_css.js`, `debian/tests/pkg-js/test`
 - Evidence: `debian/node-cssfilter.install` contains `dist usr/share/nodejs/cssfilter`; package.json has `"main": "lib/index.js"`; the upstream tests start with `var filterCSS = require('../');` and `require('../lib/parser')`; `debian/tests/pkg-js/test` runs `mocha -t 5000 -R spec`.
 - Problem: Installing only dist/ puts a browserify UMD bundle (whose top-level IIFE never assigns `module.exports`) and its minified copy into /usr/share/nodejs/cssfilter/, with no package.json and no lib/. Debian Node.js resolves `require('cssfilter')` to /usr/share/nodejs/cssfilter/ and needs a package.json "main" (=> lib/index.js) or an index.js there, neither of which is installed, so the module is not loadable by any Node consumer
 — the package's only purpose. The pkg-js autopkgtest compounds this: its tests use source-tree-relative requires and `mocha`/`node-should` are only listed in Build-Depends-Indep with no `debian/tests/control` (or `debian/tests/pkg-js/control`) declaring them as test Depends, so the test cannot run against the installed package.
 - Fix: Install the loadable module (e.g. `lib usr/share/nodejs/cssfilter` plus package.json) in `debian/node-cssfilter.install`, moving the browser bundle (if wanted at all) to /usr/share/javascript or similar, and declare the test dependencies via `debian/tests/control` (`Depends: node-mocha, node-should`) so the autopkgtest

2. Standards-Version 4.7.4 predates the current policy

 - Files: `debian/control`
 - Evidence: `Standards-Version: 4.7.4`; current Debian Policy is 4.7.4.1 (2026-03-31).
 - Problem: A brand-new package should declare the current Standards-Version (Policy §4.1).
 - Fix: Bump to 4.7.4.1 after checking the A10.2 upgrading-checklist entry for anything affecting the package.

3. uscan finds only upstream versions older than the packaged one

 - Files: `debian/watch`
 - Evidence: upstream `0.0.10`, packaged `0.0.11`
 - Problem: The newest version uscan finds with `debian/watch` is older than the version in `debian/changelog`, so the watch file does not find the packaged release: it may look in the wrong place, or the versions may need mangling to compare.
 - Fix: Check where `debian/watch` looks and how it mangles versions.


Thanks!

Full review details: https://dfsg-new-queue.debian.org/reviews/node-cssfilter

We believe that the bug you reported is fixed in the latest version of
node-cssfilter, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1149832@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Edward Betts <edward@4angle.com> (supplier of updated node-cssfilter package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 03 Oct 2026 14:21:33 +0100
Binary: node-cssfilter
Source: node-cssfilter
Architecture: all source
Version: 0.0.11-1
Distribution: unstable
Urgency: medium
Maintainer: Home Assistant Team <team+homeassistant@tracker.debian.org>
Changed-By: Edward Betts <edward@4angle.com>
Closes: 1149832
Description:
 node-cssfilter - CSS declaration sanitizer with configurable allowlist
Changes:
 node-cssfilter (0.0.11-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1149832)
Checksums-Sha1:
 bdae56f9241d51378140ea0d72c7bc90680b7776 2308 node-cssfilter_0.0.11-1.dsc
 54f16a2579da6e04256dc927dd87cf0eb638a5bc 10712 node-cssfilter_0.0.11.orig.tar.xz
 4ff2540b77ee4b14685ddac0171a42644dbe05ca 2128 node-cssfilter_0.0.11-1.debian.tar.xz
 3199b09c79ad2101faa12823af023337c2fe6582 11080 node-cssfilter_0.0.11-1_all.deb
 cfff41c77d4ce7497f48a3252af74be2c1b6a24f 18636 node-cssfilter_0.0.11-1_amd64.buildinfo
Checksums-Sha256:
 fb7066217e79908060caddf228df6beef01cc5a799251202d597d0ddda70bcb6 2308 node-cssfilter_0.0.11-1.dsc
 66a321b5af8c2595589575c6b1b31e80b9222c1626bb85b8056a65bcc09669a6 10712 node-cssfilter_0.0.11.orig.tar.xz
 9a79e8c770200b44beb054cbec23bfeb62f6563792253b89afd0d27f1f323fbb 2128 node-cssfilter_0.0.11-1.debian.tar.xz
 22ec454960f30a3998aeaa345d153e37fae179c7f64fdbd7ccd706cd2eec1a8f 11080 node-cssfilter_0.0.11-1_all.deb
 20411c72f84292eb8098063023700858065bed2cb20eebe00921f3022533e51a 18636 node-cssfilter_0.0.11-1_amd64.buildinfo
Files:
 08727eb7ac18701050360e43e1a9b8a4 2308 javascript optional node-cssfilter_0.0.11-1.dsc
 de6dbbe15e573defbb8eb57188e3f2b2 10712 javascript optional node-cssfilter_0.0.11.orig.tar.xz
 38c0fc698c92351bf71943ce829f8595 2128 javascript optional node-cssfilter_0.0.11-1.debian.tar.xz
 384814254dbd6fcbb0ae694e358ec344 11080 javascript optional node-cssfilter_0.0.11-1_all.deb
 44ec6f0767c108ca67dbeff815c37695 18636 javascript optional node-cssfilter_0.0.11-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE+4rPp4xyYInDitAmlgWhCYxjuSoFAmrBK0MACgkQlgWhCYxj
uSrAnA/9HtXOHTG//HZRkpqIsu4Nc3dLrlIMOd0CTFq/9b1PVChTYMmxBI2Fw6ZL
Cj64BxGynDlF6SqIVeTXFMLOBLE/9Qq0CPbXwAhdbxOw1J9zylrnVoNL/+JoBLmI
Gwkl6lKMMFClk0QMD/OWq+ZNio3VfBRP7VAOXvdawcIPkgG9l9603l0LV0qbTl8S
v3mGkzD6jrGRJCG8Va9whkhT2vDOfpYBMoeEv/k2ZV2e6WkkFUciFSasAGKdBSpA
mgqr6zbdtv8ZP/BLeFGoFmtBGq/bs4b+dyMQ4C7F6IPhPBTO5Tffawm2thSKKyKg
CfG6isosr7wSRzGbEjnZCRd3gqB05nq7A0aMjKE2JPqntxptX54PimHxaHhdgguO
sF3guZliRMCLi7bvxjJLGYPVQAG5mW942z6IU7fn8gM7R+Y//SZQAcCg6A2ZEBnG
r+XmnWnCcktbHvNNCVesEh/+/po5Hb3Qfm8jrzy57NY+KdRLF5vDYXk7LQ9+Q0gP
cbnonubY4uGK2OkfNHaK4RVxKp+JDOgGzgupNGMzSlo1LuNLDBIz2wd3UrQ7BgMK
NQt+V9K8e2HxxXtKg77h4saX4tKgLYf+g9YcVKbBRYv+gW5Zlo3X1CAt0InihYpz
QRYqXtZPfp5OmigJAzSGpSVg0aa43BBx9q8i6iMHMwbZ3Bw8mRo=
=XuIN
-----END PGP SIGNATURE-----

Hi Andrew,

Thanks for the review!

I'm confused. The package includes package.json and autopkgtest test
works, it picks up the test dependencies from Build-Depends-Indep. The
pkg-js runner creates a temporary directory, links lib/ and package.json
from /usr/share/nodejs/cssfilter, and copies only the tests from the
source tree into it.

$ dpkg -L node-cssfilter
/.
/usr
/usr/share
/usr/share/doc
/usr/share/doc/node-cssfilter
/usr/share/doc/node-cssfilter/README.md
/usr/share/doc/node-cssfilter/changelog.Debian.gz
/usr/share/doc/node-cssfilter/copyright
/usr/share/nodejs
/usr/share/nodejs/cssfilter
/usr/share/nodejs/cssfilter/dist
/usr/share/nodejs/cssfilter/dist/cssfilter.js
/usr/share/nodejs/cssfilter/dist/cssfilter.min.js
/usr/share/nodejs/cssfilter/lib
/usr/share/nodejs/cssfilter/lib/css.js
/usr/share/nodejs/cssfilter/lib/default.js
/usr/share/nodejs/cssfilter/lib/index.js
/usr/share/nodejs/cssfilter/lib/parser.js
/usr/share/nodejs/cssfilter/lib/util.js
/usr/share/nodejs/cssfilter/package.json
$

Thanks. I'll fix this.

Upstream forgot to tag `0.0.11`.

Cheers,

Edward

The LLM is really keen on explaining why the tests don't happen, but I
think the process of triggering the tests happens in a lot of sneaky
ways in Debian, with (inevitably) lots of language-specific stuff that
it doesn't understand.

I'm working hard to tune down these false positives, but ultimately the
only way to do this right will be to do an actual clean-room build on
upload.  I'll get to that in due course, but until I can do that we'll
get this kind of issue.

Overall these reviews do seem to be catching some quite useful things,
but the DFSG team are only using them as a guide, and verifying the
findings that we believe are blockers (not the ones the LLM thinks are
blockers either).

Don't.  It's not needed - this is a finding that I have disabled now -
the 4th digit is not needed.

Thanks,
Andrew.

----------------------------------------------------------------------