In the past 4 months, 818 new packages were added to the CRAN package repository. 100 packages were unarchived and 248 were archived. The following shows the growth of the number of active packages in the CRAN package repository:

graphic without alt text

On 2020-12-31, the number of active packages was around 16851.

Changes in the CRAN Repository Policy

The Policy now says the following:

  • For R version 4.0 or later (hence a version dependency is required or only conditional use is possible), packages may store user-specific data, configuration and cache files in their respective user directories obtained from tools::R_user_dir(), provided that by default sizes are kept as small as possible and the contents are actively managed (including removing outdated material).
  • Security provisions must not be cicrumvented, for example by not verifying SSL certificates.
  • Downloads of additional \[.........\] For downloads of more than a few MB, ensure that a sufficiently large timeout is set.
  • For a package update, please check that any packages depending on this one still pass R CMD check: \[.........\] If possible, check reverse strong dependencies, reverse suggests and the recursive strong dependencies of these (by tools::package_dependencies(reverse = TRUE, which = "most", recursive = "strong")).

The CRAN URL checks info now says

  • The CRAN submission checks run by R CMD check –as-cran check the availability of URLs in files including DESCRIPTION, CITATION, NEWS.Rd, NEWS.md, README.md, and the .Rd help pages and HTML files in inst/doc.
  • A surprisingly large number of websites use redirection and the issues may apply to a site redirected to. \[.........\] Where redirection is permanent you should use the redirected URL (see RFC 7231).

CRAN package submissions

CRAN mirror security

Currently, there are 104 official CRAN mirrors, 77 of which provide both secure downloads via https and use secure mirroring from the CRAN master (via rsync through ssh tunnels). Since the R 3.4.0 release, chooseCRANmirror() offers these mirrors in preference to the others which are not fully secured (yet).