Guidelines

Reviewing Guidelines

Version number not increased (unless changes to package-level metadata only)
Code designed in a way that freeze REAPER for ~>1s or unnecessarily risks user data
Package display name too far from the action filenames (hard to search)
Exceedingly large version number segment in risk of eventually reaching the 16-bit limit
Externally-sourced files (except extensions and themes)
For extension and themes: external URL is not pinned to the specific version or does not forever permit download of historic versions for downgrading
Index modified (should let reapack-index do it automatically)
os.execute/io.popen usage vulnerable to command injection
Letters in the version name without intent of making a pre-release (or vice-versa)
Multiple related actions submitted as separate packages rather than one
New version number lower than the previous (eg. 1.19 -> 1.2, maybe the intent was 1.20)
File installed on an unsupported platform (should be fixed to be cross-platform if possible, otherwise the file must only be installed on supported platforms via @provides) (eg. Windows-only backslashes should not be used in paths)
ReaImGui with backward-compatibility disabled or bypassed
Unnecessarily heavy or installs huge amount of files (some users install everything!)

Discourage dependencies on script files from other packages (preferably bundle in the package instead) (exceptions: Lokasenna GUI, Scyte, Ultrashall)
Main file renamed (= new package), action/JSFX file renamed (= shortcut loss/broken projects...)
No changelog for update
Weirdly large version skip (eg. 2.1 -> 2.11, maybe the intent was 2.1.1)

(if few and 100% obvious – otherwise request changes or ask confirmation)

Script names not using sentence case
Any reapack-index validation errors
Bad/missing author prefix or file extensions (author prefix should match other submissions by the same user)
Characters in filenames illegal on Windows
Duplicate metadata header or misc metadata oddities
Incorrect Action List section(s)
Incorrect file type (eg. JSFX in a script package not marked as an effect in @provides)
Library files registered in the Action List (or vice-versa)
Miscategorized (wrong folder)
More than one version's worth of release notes in the changelog
Typos in filenames or metadata (including fixing Midi into MIDI)
Version number in the changelog
Incorrect paths to other package files in code
Old changelog leftover from a previous version

Can optionally comment on the code as a courtesy (not as a requirement for merging, packaging review is not a code review).