Run renv snapshot to write your exact package versions into renv.lock, then scan that lock file with a tool that reads it. OSV-Scanner lists renv.lock among its supported lock files. The scan covers R packages only, not R itself, system libraries or compilers.
What renv.lock is
The renv documentation describes renv as a way to create reproducible environments for R projects. Running renv init gives each project its own package library. The lock file is a JSON file that records the information needed to recreate the project, in two parts: the R version and repositories, and one record per package with the details needed to reinstall that exact version. Sources include CRAN, Bioconductor, GitHub, GitLab and Bitbucket.
For security work, that file is the inventory. Without it, you are guessing what a collaborator's machine runs.
Steps
- In the project, run renv snapshot so the lock file matches the library you actually use.
- Commit renv.lock with the code.
- Point a lock file scanner at it. OSV-Scanner's source scan accepts renv.lock.
- Read the results by package and version, then decide which to update.
- After updating, run the analysis again, snapshot, and commit the new lock file.
renv::snapshot()
osv-scanner scan source -L renv.lock
What the scan does not see
The renv article is direct about its own limits. It tracks the R version but does not install it, and it does not manage Pandoc, the operating system, or system libraries and compilers. It suggests Docker for those.
So a clean result on renv.lock means no known vulnerabilities in the R packages it lists. Check the other layers separately:
| Layer | How to check |
|---|---|
| R packages | Lock file scan |
| R itself | Compare your version to the release the R project currently supports |
| System libraries | Scan the operating system or container image |
| Data and credentials | Review by hand, this is not a dependency question |
Handling findings in a paper pipeline
An update can change numerical results. A sensible order:
- Read the advisory first. Many apply to features your analysis never uses, such as network or file parsing functions.
- Update in a branch and rerun the analysis.
- Compare outputs. If they match, merge.
- If they differ, document why you are keeping the old version, and keep that environment off shared servers and off the network.
Mixed language projects
Many labs combine R with Python or command line tools. Scan each lock file in the repository, not just one. OSV-Scanner's source scan can be pointed at a folder and picks up the supported lock files it finds, so a project with renv.lock and requirements.txt can be covered in one run. Keep the combined output with the release so a reader sees the whole picture.
Try it yourself
Open the SCA demo and watch how a lock file turns into a package list with matched advisories. The R flow is the same idea with a different file.
Click through it at your own pace, or open it full screen.
Safeguard offers SBOM and dependency scanning. For R projects, check the supported ecosystems before relying on it, or try the free scan on a repository to see what it picks up.
Quick check
Does renv fix vulnerabilities?
No. It records and restores versions. You still have to read the scan results and update packages.
Should renv.lock be committed?
Yes. It is the record of what the project used, and a scanner needs it.
Sources
Last reviewed: 19 October 2026.
