Some other examples: https://github.com/cran/archetypes/commit/c4b904b4b83392724ab1bb68dad2046150aba448#diff-35ba4a2677442e210c23a00a5601aba3
https://github.com/cran/bartMachine/commit/aa807bf660925220891c5c2edeba08bde4a23481#diff-35ba4a2677442e210c23a00a5601aba3 https://github.com/cran/bfp/commit/4e28e0919b7f7f26ccd793441d2409aba06e4541#diff-35ba4a2677442e210c23a00a5601aba3 https://github.com/cran/biomod2/commit/8b5fbf1e5e71d9bbe2408184577d309a5eddc2b1#diff-35ba4a2677442e210c23a00a5601aba3 https://github.com/cran/copula/commit/ac3b475d61c7ed806da2edf3f09e20f2e3b713da#diff-35ba4a2677442e210c23a00a5601aba3 https://github.com/cran/cubature/commit/5132c784a9178bf0a0c5424848fc805be7fa8822#diff-35ba4a2677442e210c23a00a5601aba3 https://github.com/cran/Delaporte/commit/f4c10667f1b21f7dd7286263010b5d91f920cf99#diff-35ba4a2677442e210c23a00a5601aba3 https://github.com/cran/DiagrammeR/commit/3b753926be91aaaa35349b8422b8dcd303437c2b#diff-35ba4a2677442e210c23a00a5601aba3 https://github.com/cran/diffobj/commit/d86edd6a581c8de695d9d70f2621e7cac8febf45#diff-35ba4a2677442e210c23a00a5601aba3 https://github.com/cran/e1071/commit/bb30e53080210817e41e8f45397c9b064de9280d#diff-35ba4a2677442e210c23a00a5601aba3 https://github.com/cran/ElemStatLearn/commit/4ab2e88d5b0b90cdaaa3b20d8113bc203a01f7ea#diff-35ba4a2677442e210c23a00a5601aba3 https://github.com/cran/emplik/commit/344f321e5cd2c16878948de01191cd7cb678027a#diff-35ba4a2677442e210c23a00a5601aba3 https://github.com/cran/etm/commit/025e60458b3618dc86da72b9c97448eaec94fc37#diff-35ba4a2677442e210c23a00a5601aba3 https://github.com/cran/expoRkit/commit/93b6dca431ae439c473670791754a18f52fea816#diff-35ba4a2677442e210c23a00a5601aba3 https://github.com/cran/fclust/commit/504393d27fea13b46fde04ea9444905a2538476b#diff-35ba4a2677442e210c23a00a5601aba3 https://github.com/cran/fields/commit/9d9323471169a1a557415452432b8ca00d579329#diff-35ba4a2677442e210c23a00a5601aba3 https://github.com/cran/flexclust/commit/b455b290dde0917bb04ee73387e24d46546e0ecb#diff-35ba4a2677442e210c23a00a5601aba3 On Fri, May 3, 2019 at 11:55 AM Max Kuhn <mxk...@gmail.com> wrote: > > I've noticed a trend in the last year of a CRAN maintainer making > modifications to packages without notification to the package authors or the > community. Some times these have been made during a submission [1] and, in > other cases, for existing packages [2]. In the latter case, we intuit that > there are some cases where the maintainers have not responded to > communications about required changes to existing versions. > > In some cases, the changes are minor (see rngtools example linked below) but > also come with a strict R version dependency on the *current* version. This > causes a considerable number of problems for these packages and their > reverse dependencies. Since the reasons for the changes are not public, it is > unclear why they could not have been considerably less invasive. The > process of making these changes is in direct opposition to the CRAN > policies, such as > > > If for some reason the submission has to be made by someone else (for > > example, a co-author) this needs to be explained, and the designated > > maintainer will need to confirm the submission. > > > If an update will change the package’s API and hence affect packages > > depending on it, it is expected that you will contact the maintainers of > > affected packages and suggest changes, and give them time (at least 2 > > weeks, ideally more) to prepare updates before submitting your updated > > package. > > It is understandable that the CRAN maintainers require package maintainers > to check reverse dependencies. There doesn't appear to be a good reason that > CRAN maintainers do not follow these rules. > > In the case where a package maintainer has not properly responded to a > substantive issue, it is unclear what should happen. This does put CRAN in a > bad position, but one would hope that minimally invasive changes be made and > that the impact on the reverse dependencies be measured and processed like a > normal CRAN submission. In particular, the effect of making quadprog >= > 3.6.0 has been significant due to failures to install reverse dependencies. > > Perhaps some minimal changes to the process could be: > > 1. There should be some sort of visible status (analogous to ORPHANED) that > clearly indicates this has happened, so users can better understand the > context of the change. An update to any NEWS file would also be appropriate. > > 2. CRAN should, at least temporarily, be listed as an author. > > 3. Reverse dependency authors who are affected are notified a priori. > > Has anyone else experienced similar situations and how did you deal with the > consequences of the changes? > > Examples > > [1] https://github.com/gdkrmr/dimRed/issues/27#issuecomment-437458488 > > [2] > > https://github.com/cran/rngtools/commit/c9c036b18e0bf6f20afcab15a2b38083aaf62da7 > > and > > https://github.com/cran/quadprog/commit/a559f064e20f803ab3ffde413e7686d9c6299083 ______________________________________________ R-package-devel@r-project.org mailing list https://stat.ethz.ch/mailman/listinfo/r-package-devel
