-
Notifications
You must be signed in to change notification settings - Fork 343
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support for scanning renv lockfiles for the R language #642
Comments
I'd actually been looking into this a few weeks ago; would you mind providing some example lockfiles for fixtures? I can dig these out from open source projects, but if you know of any special cases that would be worth having tests for that'd be great to hear (e.g. the NPM ecosystem supports the same package multiple times with different versions and peer dependencies, ruby supports different OSs, Go has Also for future me: https://rstudio.github.io/renv/articles/lockfile.html |
I'm not too familiar with any special cases but perhaps a good foundation would be the renv project's tests? For example: Other than that, I'm aware there are changes in the works for things like dev dependencies (rstudio/renv#1695). But actually from a quick look, it sounds like this isn't something osv-scanner supports yet either (#332). |
Part of #642 See G-Rath/osv-detector#235 for the journey I went on with R for this
Following the addition of CRAN for the R language to the OSV database (google/osv.dev#1477), it would be helpful if this CLI supported scanning
renv
lockfiles.A workaround at present is to parse the lockfile with jq and generate a custom lockfile:
The text was updated successfully, but these errors were encountered: