What Happened
rig 0.10.0 and 0.11.0 introduced rig proj, a project workflow built around an rproj.toml manifest and an rproj.lock file. Teams can initialize a project, import dependencies from DESCRIPTION or an renv lock file, declare regular, development and optional dependencies, and lock exact package versions. rig proj sync creates a recreatable .rvenv environment; rig run can lock and sync before executing R, a script or a named project command [1].
This release is relevant to R-based applications and publishing workflows, including Shiny and Quarto. The available release details do not establish new features for Posit’s other tools, Streamlit, Jupyter, Gradio, Chainlit, Modal or Replicate [1].
Why It Matters to Businesses
A committed manifest and lock file give developers, CI jobs and deployment pipelines a common dependency specification without committing a machine-specific environment. That reduces version drift between development and production, though it does not by itself guarantee identical behavior across operating systems or external services [1].
Kimbodo Engineering Perspective
The useful change is not another way to install packages; it is a clearer boundary between declared requirements, resolved versions and disposable runtime state. We would test rig against an existing renv-based workflow before migrating a production app. Repository selection also needs deliberate review: projects default to P3M’s CRAN and Bioconductor repositories rather than inheriting global rig repository settings [1].
How We Would Implement It
- Import an existing DESCRIPTION or renv lock file, review dependency groups and repository entries, then commit rproj.toml and rproj.lock while excluding .rvenv [1].
- In CI, sync from the lock file, run tests and render or exercise the application. Build deployment artifacts from that tested environment rather than resolving dependencies again at deploy time.
- Document when lock files are updated. Use exclude-newer where repository metadata supports it, or prefer-binary when faster installation is worth accepting an older compatible package [1].
Risks, Costs and Security
rig proj is new, so teams should validate platform coverage, package compatibility and migration behavior before relying on it for critical releases [1]. Lock files constrain versions but do not make packages trustworthy: retain vulnerability review, approved repositories and deployment testing. Cached environments can reduce repeated installation work, but their storage and cleanup still need operational ownership [1].
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our AI Application Development practice, or Estimate My AI Application.
