-
Notifications
You must be signed in to change notification settings - Fork 772
Description
I don't know whether the issue tracker is the best place to discuss this (compared to other excellent EB communication channels), but let me try it here.
I recently started a PR to include R-bundle-CRAN based on R/4.3.3-gfbf-2023b which already contains an important security patch.
Alongside that, there are two other pull requests with a possible divergent dependency for R.
One is also R-bundle-CRAN and the other one is R-bundle-Bioconductor. The latter two are placed by @branfosj (Great job Simon to beat two beasts!). These two PRs are based on R v4.4.1 (which officially includes the security correction).
The three key PRs above are open, but once any of them gets merged, the other two (maybe even other PRs?) get affected by dependency conflicts, specifically with respect to the version of R.
I like to propose to have an open discussion (maybe here, or via another communication means), to go through this, and make a decision to unify all these useful efforts for the community, so that we do not end up with divergent dependencies for two R bundles (although the build tests capture the possible flaw).
Because I do not know for sure who else besides Simon would be interested/relevant, I am gonna drag @boegel into this (Sorry Kenneth, but to me, you are the natural choice ;-) ).