Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

R v4.4.0 needed for r-notebooks due to security vulnerability #2116

Open
bryancquach opened this issue May 1, 2024 · 3 comments
Open

R v4.4.0 needed for r-notebooks due to security vulnerability #2116

bryancquach opened this issue May 1, 2024 · 3 comments
Labels
tag:Upstream A problem with one of the upstream packages installed in the docker images type:Enhancement A proposed enhancement to the docker images

Comments

@bryancquach
Copy link

What docker image(s) is this feature applicable to?

r-notebook

What change(s) are you proposing?

Update Dockerfile to install R v4.4.0.

How does this affect the user?

A security vulnerability was identified for versions of R <4.4.0. Consequently, the most recent versions of some CRAN packages like Matrix and MASS now require R versions >=4.4.0. These packages are dependencies for many popular R packages such as tidyverse. Providing an updated R version will circumvent the need to resolve a potentially long list of common dependencies that will need to be explicitly installed and resolved prior to installing an R package.

Anything else?

No response

@bryancquach bryancquach added the type:Enhancement A proposed enhancement to the docker images label May 1, 2024
@massongit
Copy link

datascience-notebook also needs to update R.

@mathbunnyru
Copy link
Member

Note - we don't pin any specific R version in our images and images are rebuilt weekly.
So, there is nothing to do within this project - as soon all the dependencies are updated, new R version will be installed automatically.

Providing an updated R version will circumvent the need to resolve a potentially long list of common dependencies that will need to be explicitly installed and resolved prior to installing an R package.

This is true. If you want this to be resolved asap, I highly suggest to help dependent projects to update (this also includes working on recipes in conda-forge).

@mathbunnyru mathbunnyru added the tag:Upstream A problem with one of the upstream packages installed in the docker images label May 5, 2024
@mathbunnyru
Copy link
Member

Btw, conda-forge team is working on updating r-base to 4.4.0 (it has to be done first): conda-forge/r-base-feedstock#297

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
tag:Upstream A problem with one of the upstream packages installed in the docker images type:Enhancement A proposed enhancement to the docker images
Projects
None yet
Development

No branches or pull requests

3 participants