Versioning

[SFJohnson24]

CDISC Dependency Management Policy

Overview

This document outlines CDISC's policy for managing dependencies in the CDISC Rules Engine (CORE) and the Conformance Rules Editor. This policy aims to provide clarity on when and why dependencies will be updated, and how users should handle potential conflicts between their applications and our tools.

Policy Statement

CDISC maintains specific versions of dependencies for our tools to ensure stability and predictability. Our approach to dependency management follows these principles:

1. Security and Deprecation Updates: Dependencies will be updated when necessary to address:

   • Security vulnerabilities
   • Deprecated packages or features
   • End-of-life support for dependencies

2. Feature-Driven Updates: Dependencies will only be updated to support CDISC Rules Engine and Conformance Rules Editor core functionality. We will not update dependencies to accommodate specific user environments, external implementations, or features outside our repositories.

3. Version Support: We maintain compatibility with specific versions as documented in:

   • Python versions specified in the README.md of the CDISC Rules Engine
   • Dependencies listed in the requirement.txt of the CDISC Rules Engine
   • Node.js and package versions specified in package.json files for the Conformance Rules Editor located here and here respectively

Integration Guidelines

When integrating CDISC tools with your applications:

1. Environment Management: Users are responsible for creating and managing their own environments when conflicts arise between CDISC tool dependencies and their application requirements.

2. Compatibility Resolution: If your application requires dependency versions that conflict with CDISC tools:

   • Create isolated environments for running CDISC tools
   • Consider a message broker between the environments to coordinate communication across the separate environments
   • Use containerization (Docker) when appropriate
   • Implement proper dependency management in your application to avoid direct conflicts

3. Issue Reporting Scope:

   • Issues related to core functionality within our documented supported environments should be reported through the GitHub issue tracker
   • Version conflicts between CDISC tools and your specific implementation are outside our support scope
   • Users are responsible for resolving dependency conflicts in their own environments and implementations

Dependency Review Process

CDISC periodically reviews dependencies to:

• Identify potential security vulnerabilities
• Address deprecation notices
• Ensure ongoing compatibility with supported platforms

We will communicate significant dependency changes through release notes and documentation updates.

---

This policy may be updated periodically to reflect evolving best practices and technological changes.