[R-pkg-devel] CRAN modifications of packages

[Max Kuhn]

Some other examples:

https://github.com/cran/archetypes/commit/c4b904b4b83392724ab1bb68dad2046150aba448#diff-35ba4a2677442e210c23a00a5601aba3

https://github.com/cran/bartMachine/commit/aa807bf660925220891c5c2edeba08bde4a23481#diff-35ba4a2677442e210c23a00a5601aba3

https://github.com/cran/bfp/commit/4e28e0919b7f7f26ccd793441d2409aba06e4541#diff-35ba4a2677442e210c23a00a5601aba3

https://github.com/cran/biomod2/commit/8b5fbf1e5e71d9bbe2408184577d309a5eddc2b1#diff-35ba4a2677442e210c23a00a5601aba3

https://github.com/cran/copula/commit/ac3b475d61c7ed806da2edf3f09e20f2e3b713da#diff-35ba4a2677442e210c23a00a5601aba3

https://github.com/cran/cubature/commit/5132c784a9178bf0a0c5424848fc805be7fa8822#diff-35ba4a2677442e210c23a00a5601aba3

https://github.com/cran/Delaporte/commit/f4c10667f1b21f7dd7286263010b5d91f920cf99#diff-35ba4a2677442e210c23a00a5601aba3

https://github.com/cran/DiagrammeR/commit/3b753926be91aaaa35349b8422b8dcd303437c2b#diff-35ba4a2677442e210c23a00a5601aba3

https://github.com/cran/diffobj/commit/d86edd6a581c8de695d9d70f2621e7cac8febf45#diff-35ba4a2677442e210c23a00a5601aba3

https://github.com/cran/e1071/commit/bb30e53080210817e41e8f45397c9b064de9280d#diff-35ba4a2677442e210c23a00a5601aba3

https://github.com/cran/ElemStatLearn/commit/4ab2e88d5b0b90cdaaa3b20d8113bc203a01f7ea#diff-35ba4a2677442e210c23a00a5601aba3

https://github.com/cran/emplik/commit/344f321e5cd2c16878948de01191cd7cb678027a#diff-35ba4a2677442e210c23a00a5601aba3

https://github.com/cran/etm/commit/025e60458b3618dc86da72b9c97448eaec94fc37#diff-35ba4a2677442e210c23a00a5601aba3

https://github.com/cran/expoRkit/commit/93b6dca431ae439c473670791754a18f52fea816#diff-35ba4a2677442e210c23a00a5601aba3

https://github.com/cran/fclust/commit/504393d27fea13b46fde04ea9444905a2538476b#diff-35ba4a2677442e210c23a00a5601aba3

https://github.com/cran/fields/commit/9d9323471169a1a557415452432b8ca00d579329#diff-35ba4a2677442e210c23a00a5601aba3

https://github.com/cran/flexclust/commit/b455b290dde0917bb04ee73387e24d46546e0ecb#diff-35ba4a2677442e210c23a00a5601aba3

On Fri, May 3, 2019 at 11:55 AM Max Kuhn <mxkuhn using gmail.com> wrote:
>
> I've noticed a trend in the last year of a CRAN maintainer making  modifications to packages without notification to the package authors or  the community. Some times these have been made during a submission [1] and,  in other cases, for existing packages [2]. In the latter case, we intuit  that there are some cases where the maintainers have not responded to  communications about required changes to existing versions.
>
> In some cases, the changes are minor (see rngtools example linked below)  but also come with a strict R version dependency on the *current* version.  This causes a considerable number of problems for these packages and their  reverse dependencies. Since the reasons for the changes are not public, it is unclear why they could not have been considerably less invasive.   The process of making these changes is in direct opposition to the CRAN  policies, such as
>
> > If for some reason the submission has to be made by someone else (for  example, a co-author) this needs to be explained, and the designated  maintainer will need to confirm the submission.
>
> > If an update will change the package’s API and hence affect packages  depending on it, it is expected that you will contact the maintainers of  affected packages and suggest changes, and give them time (at least 2  weeks, ideally more) to prepare updates before submitting your updated  package.
>
> It is understandable that the CRAN maintainers require package maintainers  to check reverse dependencies. There doesn't appear to be a good reason  that CRAN maintainers do not follow these rules.
>
> In the case where a package maintainer has not properly responded to a  substantive issue, it is unclear what should happen. This does put CRAN in  a bad position, but one would hope that minimally invasive changes be made  and that the impact on the reverse dependencies be measured and processed  like a normal CRAN submission.  In particular, the effect of making quadprog >= 3.6.0 has been significant due to failures to install  reverse dependencies.
>
> Perhaps some minimal changes to the process could be:
>
> 1. There should be some sort of visible status (analogous to ORPHANED)  that clearly indicates this has happened, so users can better understand  the context of the change. An update to any NEWS file would also be  appropriate.
>
> 2. CRAN should, at least temporarily, be listed as an author.
>
> 3. Reverse dependency authors who are affected are notified a priori.
>
> Has anyone else experienced similar situations and how did you deal with  the consequences of the changes?
>
> Examples
>
> [1] https://github.com/gdkrmr/dimRed/issues/27#issuecomment-437458488
>
> [2]
>
> https://github.com/cran/rngtools/commit/c9c036b18e0bf6f20afcab15a2b38083aaf62da7
>
> and
>
> https://github.com/cran/quadprog/commit/a559f064e20f803ab3ffde413e7686d9c6299083