cranreg

Documentation

Overview

Package cranreg asks CRAN what it knows about the R packages a diff touches (renv.lock resolves CRAN-sourced packages). deps.dev has no CRAN system at all, so — like Packagist, hex.pm and pub.dev before it — this package IS the metadata layer for R, not a fallback:

• Release ages and the ⏱ cooldown flag, from METACRAN's per-version timeline (crandb, the CouchDB API behind r-pkg.org, mirrors the canonical CRAN metadata including publication dates for every version ever released — CRAN archives old releases, it does not delete them).
• Archived packages (CRAN's package-level removal from the index; `install.packages` stops resolving them) land in the deprecation lane.
• Per-version License fields from the DESCRIPTION of each release power license-change detection, exactly like the other registry layers (both sides must be known; case-only differences ignored).
• Unlisted detection, double-checked against CRAN itself: a version missing from the crandb timeline could just be mirror lag, so before claiming anything lockvet HEADs the version's source tarball on cran.r-project.org — both the current src/contrib location and the Archive one. Only a version CRAN has in neither place keeps the flag; packages crandb does not know at all are never flagged. The renv.lock parser marks GitHub/GitLab/local/ remote installs NonRegistry besides, so dev versions never reach this check.
• The upstream source repository from the DESCRIPTION URL (or BugReports) field, which the changelog layers turn into verified compare links and release notes.

Bioconductor packages are left to the OSV layer alone: crandb covers CRAN only, and lockvet makes no claims it cannot back.

Neither crandb nor cran.r-project.org sends CORS headers, so the browser (wasm) playground skips this layer; the native CLI is unaffected.

Index

• Variables
• func Annotate(diffs []diffx.FileDiff, freshDays int) (bool, error)
• func Latest(name string) (string, error)

Variables

var BaseURL = "https://crandb.r-pkg.org"

BaseURL is the crandb (METACRAN) API base; a var so tests can fake it.

var Enabled = true

Enabled gates the whole layer; the wasm playground sets it false (no CORS on either endpoint).

var MirrorURL = "https://cran.r-project.org"

MirrorURL is the canonical CRAN mirror used ONLY to double-check absence before an unlisted claim; a var so tests can fake it.

var Now = time.Now

Now is a var so tests can pin the clock.

Functions

func Annotate

func Annotate(diffs []diffx.FileDiff, freshDays int) (bool, error)

Annotate fills CRAN metadata on the diffs; see the package comment for what it covers. The returned bool reports whether at least one package was actually vetted against CRAN (deps.dev never covers CRAN, so this decides whether release metadata was checked at all for R). freshDays mirrors -fresh-days. Best-effort: per-package failures skip that package; only total failure returns an error.

func Latest

func Latest(name string) (string, error)

Latest returns the current CRAN release of name, for `lockvet pkg cran:<name>`.