use renv package to create lock state for what versions of what packages are used

The EJAM repo’s dependency state is defined mainly by EJAM/DESCRIPTION and EJAM/data-raw/Dockerfile. There is no checked-in lockfile, and the Docker image uses rocker/rstudio:latest plus mostly unversioned install2.r installs. That means the repo does not record the actual resolved R package set, only minimum version floors.

We should add a lock state (renv.lock or equivalent). That turns future dependency sweeps into real versioned upgrades instead of guesswork.

This issue potentially affects web app if obsolete dependency is not caught or there is a problem trying to install the latest EJAM release for hosting or API purposes.

As of May, 2026:

For EJAM or a similar R package, recommendation is to use:

• renv.lock for reproducible development/ CI/ release environments since renv is the mainstream recommended solution for reproducible R package-development environments. "R Packages" guidance explicitly points to renv when you need exact-version freezing beyond DESCRIPTION (R Packages, DESCRIPTION).
• pak for installing/resolving dependencies, since the pak package is a new and useful complement to renv. pak is already used in some places in EJAM.
• DESCRIPTION + NAMESPACE for package dependency truth

renv + pak is a good current combo: renv owns the project lockfile; pak can be used as the installation backend. Current renv has official pak support, and recent renv releases continue improving that integration (pak manual, renv changelog).

renv is the lockfile/environment tool: it creates a project library and records exact package versions in renv.lock, then restores them later with renv::restore() (renv overview, lockfile docs).

pak is the modern installer/resolver: use it for fast, robust installs, GitHub/remotes, system dependency detection, and dev dependencies. It can install all development dependencies for the current package with pak::pak() when pkg = NULL (pak docs).

packrat was an older obsolete package superseded by renv.

renv does record the R version but does not install R for you. If we also need to pin/manage the R executable itself, we should add rig or containerization.