[From nobody Sat Nov  7 03:07:05 2026
Received: (at submit) by bugs.debian.org; 28 Oct 2026 13:52:56 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-118.2 required=4.0 tests=ALL_TRUSTED,BAYES_00,
 BODY_INCLUDES_PACKAGE,DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,
 DKIM_VALID_AU,DKIM_VALID_EF,FROMDEVELOPER,HAS_PACKAGE,SPF_HELO_NONE,
 SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no
 version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 20; hammy, 143; neutral, 33; spammy,
 1. spammytokens:0.855-+--browser
 hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin,
 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311,
 0.000-+--H*RT:311, 0.000-+--H*RT:108
Return-path: <emfox@debian.org>
Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:33518)
 by buxtehude.debian.org with esmtps
 (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
 (Exim 4.96) (envelope-from <emfox@debian.org>) id 1xM45I-00F0ZN-25
 for submit@bugs.debian.org; Wed, 28 Oct 2026 13:52:56 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; 
 s=smtpauto.stravinsky;
 h=X-Debian-User:Date:From:Message-Id:Subject:To:
 Reply-To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID:
 Content-Description:In-Reply-To:References;
 bh=LNftz9YD0NyaXiD0qQ/h0QuGoZ0U0FoY0/rQgfUiEMs=; b=KczSCBDrxR2dEhmwWa2D7TUiuZ
 Y6xaC3KWHPR5EofKy6pwJJArGkhun4gub5cfAkWu0+GVAYctodOnwI9Ace0ykGEuusKIK7aFUFAaK
 jfG51X+Ati64GzOwpeXoJRH+x0nV2T6J25kpCT4IUWVRKqU6wX0JGgjnQkE+yEvOue1mTIM9Qu7Ri
 kotcDLvFHQiI3F+Ya6Q0uSs8X8u6JWNBBt6DfrLo9PIku6PqKRYs8t2CfEDyr7r51Q33Dyz7FHTL6
 ngfHbpXfwmyqdlY0iY/nHbE/WE2knppfFcgoPBAgfVBV+en3DolWkrAZphb11QBkbCKxQph5Rn0KD
 Fmf+f8+w==;
Received: from authenticated-user by stravinsky.debian.org with esmtpsa
 (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
 (Exim 4.96) (envelope-from <emfox@debian.org>) id 1xM45G-002HrB-1H
 for submit@bugs.debian.org; Wed, 28 Oct 2026 13:52:54 +0000
Received: from emfox by emfox.rpwt.org with local (Exim 4.100.1)
 (envelope-from <emfox@debian.org>) id 1xM45A-00000001WH9-2KUG
 for submit@bugs.debian.org; Wed, 28 Oct 2026 21:52:48 +0800
To: submit@bugs.debian.org
Subject: node-diff: "browser" points at dist/,
 which never reaches the source tarball
Message-Id: <E1xM45A-00000001WH9-2KUG@emfox.rpwt.org>
From: Wei Zhou <emfox@debian.org>
Date: Wed, 28 Oct 2026 21:52:48 +0800
X-Debian-User: emfox
Delivered-To: submit@bugs.debian.org

Package: node-diff
Version: 8.0.4~dfsg-3
Severity: normal

package.json declares "browser": "./dist/diff.js", but dist/ is not there:
it is built by `yarn build` (rollup + uglify) and only ships in the npm
tarball.  Debian's orig comes from the GitHub archive, and Files-Excluded
lists only images, so the field points at nothing.

Node and bundlers that follow "exports" are fine; browser-resolve, which
browserify uses, prefers "browser" and gives up:

    $ echo 'module.exports = require("sinon/lib/sinon.js")' > /tmp/e.js
    $ NODE_PATH=/usr/share/nodejs browserify /tmp/e.js > /dev/null
    Error: Can't walk dependency graph: Cannot find module 'diff' from
      '/usr/share/nodejs/sinon/lib/sinon/spy-formatters.js'

node-sinon depends on diff ^8.0.4 and that file requires it, so anything that
browserifies sinon fails at build time.

Either build dist/ in debian/rules, or drop the browser/unpkg fields, which
only mean something in the npm artifact.

Thanks,
Emfox Zhou
]