sonatype-nexus-community / oysteR

Create purls from the filtered sands of your dependencies, powered by OSS Index
https://sonatype-nexus-community.github.io/oysteR/
Apache License 2.0
40 stars 9 forks source link

No cran package shows a vulnerability #68

Open sw-jakobgepp opened 10 months ago

sw-jakobgepp commented 10 months ago

Describe the bug No package on CRAN shows any vulnerabilities.

To Reproduce I got a list of available packages on CRAN (20.311) with db <- tools::CRAN_package_db()[, c("Package")]

Then I looped over all packages in batches to check them for vulnerabilities oysteR::audit( pkg = this_batch, version = rep("*", length(this_batch)), type = "cran")

where this_batch is a vector with package names, like c("data.table", "ggplot")

Expected behavior It might be correct, that no package has any vulnerabilities, it is just a feeling, that this might not be right.

Desktop (please complete the following information):

Additional context Around 50% of all available packages were also not found in the OSS Index, which I can understand.