crawlR: A Large-Scale Analysis of the R Ecosystem Using Static Program Analysis

Packages play a big part in the development of research software and have a huge influence on the quality, reproducibility, and reusability of code artifacts. For example, good packages can improve the reproducibility of code by providing well-tested, documented, and robust functions. However, packages can also introduce subtle bugs and security vulnerabilities.Over the past months we used flowR, our static program analysis framework for the R programming language, to analyze all versions (roughly 170,000) of all packages available on CRAN. This way, we obtained around 80 GB of raw data on various semantic aspects of the package's functions and variables stemming from almost three decades of R development.We record information such as call graphs, dead code, nondeterminism, usage of R features, constraints on transitive dependencies, compliance with semantic versioning, and much more. Moreover, the data is linked to the release date and download numbers of each package which allows exploring the evolution of these characteristics over time as well as weigh them by the adoption of the respective package and their transitive dependencies.With this poster, we present some of the key results of our analysis, focusing on the consequences for reproducibility and reusability. Additionally, we highlight some of the most interesting and surprising findings, such as the unusually low count of transitive dependencies, the high number of packages that do not lock their transitive dependencies, and the low number of packages that uses semantic versioning correctly.