Repository navigation
Feature request: dependency cooldown (exclude packages newer than N days) #920
Description
Problem
Supply chain attacks often get caught within days of a malicious release. A cooldown lets users skip versions that are too new. uv supports this with relative durations:
uv pip install pandas --exclude-newer "7 days"
pak has no equivalent.
Current workaround
pak::repo_add(paste0("PPM@", Sys.Date() - 7))This has gaps:
- It requires Posit Package Manager. Users on plain CRAN mirrors or other repositories get no cooldown.
- If PPM has no snapshot for the date, pak uses the next available one, which can include newer packages than requested.
- You can't set this as an environment variable that could be applied to all sessions or all users on a server.
Proposal
Add a setting that excludes any package version published less than N days ago. For example:
options(pkg.exclude_newer = "7 days")
# or
Sys.setenv(PKG_EXCLUDE_NEWER = "7 days")For reference, UV supports more than relative days to a similar syntax could be used: https://docs.astral.sh/uv/concepts/resolution/#reproducible-resolutions
Why in pak
People use pak to install R packages. This also lets renv inherit the behaviour when it uses pak.
Activity
gaborcsardi commentedon Oct 8, 2026
Python repositories have metadata about older package versions, so uv can choose an older version. CRAN-like repositories typically only contain the most recent version of each package, so there is nothing else to choose from. I.e.
https://cran.r-project.org/src/contrib/PACKAGESonly has one version of ggplot2, if that's too recent for you, then there is nothing else to use.OTOH rig can use extended metadata from PPM/P3M, and this is already implemented there, see
exclude-newerat e.g. https://rig.r-lib.org/pkg-guide.html and https://rig.r-lib.org/proj-guide.html.EDIT: actually, look here, rather: https://rig.r-lib.org/reference/pkg.html, https://rig.r-lib.org/reference/proj.html.