<p><div><div><div><div data-show-faces="false" data-height="21" data-width="100" data-layout="button_count" data-send="true" data-href="https://www.r-bloggers.com/use-github-vulnerability-alerts-to-keep-users-of-your-r-packages-safe/"></div></div><div></div></div><div></div></div>
<div>
(This article was first published on <strong><a href="https://rud.is/b/2018/11/14/use-github-vulnerability-alerts-to-keep-users-of-your-r-packages-safe/"> R – rud.is</a></strong>, and kindly contributed to <a rel="nofollow" href="https://www.r-bloggers.com/">R-bloggers)</a> </div>
<p>Despite their now inherent evil status, GitHub has some tools other repository aggregators do not. One such tool is the <a rel="nofollow" href="https://help.github.com/articles/about-security-alerts-for-vulnerable-dependencies/" target="_blank">free vulnerability alert service</a> which will scan repositories for outdated+vulnerable dependencies.</p>
<p>Now, “R” is nowhere near a first-class citizen in the internet writ large, including software development tooling (e.g. the Travis-CI and GitLab continuous integration recipes are <em>community</em> maintained vs a first-class/supported offering). This also means that GitHub’s service will never check for nor alert when a pure R package has security issues, mostly due to the fact that there’s only a teensy few of us who even bother to check packages for issues once in a while and there’s no real way to report said issues into the CVE process easily (though I <em>guess</em> I could given that my $DAYJOB is an official CVE issuer), so the integrity &amp; safety of the R package ecosystem is still in the <em>“trust me, everything’s <img alt="👍" src="https://i0.wp.com/s.w.org/images/core/emoji/11/72x72/1f44d.png?w=456&ssl=1" class="wp-smiley" data-recalc-dims="1">!!”</em> state. Given that, any extra way to keep even <em>some</em> R packages less insecure is great.</p>
<p>So, right now you’re thinking <em>“you click-baited us with a title that your lede just said isn’t possible…WTHeck?!</em>.</p>
<p>It’s true that GitHub does not consider R a first-class citizen, <em>but</em> it does support Java and:</p>
<pre><code>    available.packages() %>% 
      dplyr::as_data_frame() %>% 
      tidyr::separate_rows(Imports, sep=&quot;,[[:space:]]*&quot;) %>% # we really just
      tidyr::separate_rows(Depends, sep=&quot;,[[:space:]]*&quot;) %>% # need these two
      tidyr::separate_rows(Suggests, sep=&quot;,[[:space:]]*&quot;) %>%
      tidyr::separate_rows(Enhances, sep=&quot;,[[:space:]]*&quot;) %>%
      dplyr::select(Package, Imports, Depends) %>% 
      filter(
        grepl(&quot;rJava&quot;, Imports) | grepl(&quot;rJava&quot;, &quot;Depends&quot;) | 
          grepl(&quot;Suggests&quot;, Imports) | grepl(&quot;Enhances&quot;, &quot;Depends&quot;)
      ) %>% 
      dplyr::distinct(Package) %>% 
      dplyr::summarise(total_pkgs_using_rjava = n())
    ## # A tibble: 1 x 1
    ##   total_pkgs_using_rjava
    ##                    </code></pre>