rstudio/renv v1.2.4

renv 1.2.4

on GitHub

renv::install() and renv::restore() with pak enabled can now handle
packages hosted on a self-hosted GitLab instance. renv previously handed
pak remotes of the form gitlab@<host>::<group>/<project>, which pak was
unable to parse; renv now translates these into pkgdepends' own syntax,
gitlab::https://<host>/<group>/<project>. GitLab sub-directories are
likewise translated to pkgdepends' /-/<subdir> syntax. (#2180)

When a package fails to download, renv now reports the reason for the
failure, rather than a generic "failed to download" message. For example,
when the download destination within the renv root is not writable (as can
happen with a misconfigured shared cache), the error now says so directly.
(#2340)

Failed package downloads are now reported quietly when a later retrieval
candidate succeeds -- for example, when a binary package fails to download,
but the source fallback succeeds. If all candidates fail, the download
output is still emitted, and download errors are no longer reported twice.
(#1727)

renv::use() with pak enabled now honours the requested remotes, rather than
installing the latest version of each package from the active repositories.
Previously, a call like renv::use("generics@0.1.3") would install the
current CRAN version of generics. renv::rebuild() and renv::repair() were
affected in the same way. (#2341)

renv::remove() gains a prompt argument, and now asks for confirmation
before removing packages from a library other than the project library --
for example, when called without an activated renv project, where the
target library would be the user library. (#2331)

Removing a package record from the lockfile by setting it to NULL, e.g.
with renv::record(list(dplyr = NULL)), is now documented. (#2331)

Package projects can now request that the package itself be included in the
lockfile, by setting Config/renv/snapshot/include-self: TRUE in the package
DESCRIPTION file. This can be useful when deploying a Shiny application
that is developed as part of a package. See ?renv::snapshot for more
details. (#2285)

renv::dependencies() now detects packages referenced via
rlang::check_installed() and rlang::is_installed(). (#1936)

renv::dependencies() now infers the optional packages required by certain
testthat functions; for example, skip_if_offline() implies a dependency on
curl, and snapshot_review() implies dependencies on shiny and diffviewer.
In addition, usage of the Junit reporter is now also detected in calls to
test_check() and test_local(). (#1936)

renv::dependencies() now detects a dependency on the ragg package when the
ragg_png graphics device is requested via knitr chunk options set in a
document's YAML header. Previously, only calls of the form
knitr::opts_chunk$set(dev = "ragg_png") in code chunks were detected.
(#2311)

renv::install() with pak enabled no longer upgrades already-installed
dependencies that are only pulled in transitively -- most visibly recommended
packages such as cluster or Matrix, which previously could be rebuilt when
installing an unrelated package. renv now passes upgrade = FALSE to pak,
matching renv's own installer, while still forcing a (re)install of the
packages you explicitly request. (#2329)

Internal DESCRIPTION reads that request a package by name now error when that
package is not installed, rather than silently falling back to the DESCRIPTION
in the current working directory. (#2327)

renv now guards against corrupted cache entries that contain the wrong
package. Before installing a package from the cache, renv verifies that the
cache entry's DESCRIPTION reports the expected package name; if it does not
(for example, due to a concurrent write race on a shared cache), renv ignores
the entry and reinstalls the package instead of installing the wrong one.
renv::diagnostics() also reports any such cache entries. (#2322)

renv's file locks now record the host and process that own them. A lock held
by a process that is still alive on the same machine is no longer treated as
orphaned, even if its timestamp is stale (for example, when a large package
copy onto a shared cache takes longer than the lock timeout and the watchdog
is not refreshing the lock). This reduces the chance of a lock being stolen
from a live process, which could otherwise corrupt a shared cache. (#2322)

renv::rehash() now reminds you to run renv::repair() when it moves
packages within the active cache, since project libraries that still link to
a package's previous cache location are left with broken links. The
function's documentation has also been corrected: it no longer claims that
links to the old locations are retained.

When renv::snapshot() aborts due to a pre-flight validation failure, the
error now includes a summary of the problems that were detected (for example,
the missing packages or unsatisfied dependencies). Previously these details
were only printed to the console, so they could be lost when that output was
not visible (such as when stdout is captured).

The new lockfile() function provides a generic entry point for creating an
renv lockfile from a variety of sources. For example,
lockfile(from = "manifest.json") converts a Posit Connect manifest.json
file into a lockfile. Supply to to also write the result to disk, as in
lockfile(from = "manifest.json", to = "renv.lock"). The set of supported
sources may be expanded in future releases. (#2245)

renv::snapshot() gains a description parameter, which converts a package
DESCRIPTION (provided either as a named list of fields, or as a path to a
package directory or DESCRIPTION file) into a single lockfile record,
without requiring the package to be installed. This allows tools like
rsconnect to perform manifest-to-lockfile conversion using exported renv
APIs. (#2250)

When resolving the dependencies of a pinned package version that is absent
from the configured repositories' PACKAGES metadata and cannot be found via
crandb (for example, when offline, when using an internal mirror that cannot
reach crandb.r-pkg.org, or for non-CRAN packages), renv now downloads the
archived source tarball for that version and reads its DESCRIPTION directly.
This is authoritative wherever the package itself is reachable, and the
downloaded tarball is reused by the subsequent retrieve step. As a last
resort, if the archived tarball also cannot be read, renv falls back to the
latest version's dependencies and warns, since those dependencies may differ
from the pinned version's and could lead to an incorrect install order.
(#2315)

Fixed a regression introduced in renv 1.2.0 where installing a package from
the cellar (via install() or use()) failed to install that package's
dependencies. The graph-based installer resolved cellar packages from
metadata that omitted their Depends / Imports / LinkingTo fields; renv
now reads the package's DESCRIPTION from the cellar archive so that its
dependencies are discovered and installed. (#2313)

renv now infers some "implied" dependencies that cannot be discovered via
static analysis because they are loaded indirectly at runtime by another
package. For example, dplyr lazily loads dbplyr when working with a database
backend, so dbplyr is now recorded when a project uses both dplyr and a DBI
backend (e.g. RSQLite, RPostgres, duckdb). The rules are configurable via the
renv.dependencies.implied R option; set it to an empty list to disable this
inference entirely. (#2308)

renv::restore() gains a retry argument, controlling whether packages
that fail to install successfully are retried with their latest available
versions. This recovery was previously only offered via an interactive
prompt; retry = TRUE now enables it without prompting (useful in
non-interactive sessions such as CI), while retry = FALSE disables it
entirely. (#1893)

renv no longer treats the mere presence of a biocViews field in a
package's DESCRIPTION as proof that the package came from Bioconductor.
Some CRAN packages declare biocViews, and Posit Package Manager can serve
Bioconductor packages from a CRAN-like "R repository"; in both cases renv
now uses the Repository field to decide where a package was obtained, so
such packages are recorded as repository packages and restored from the
repository they came from. Genuine Bioconductor packages are still recognized
by their Repository stamp, including binaries served via r-universe
(stamped with a https://bioc-*.r-universe.dev URL); and when a package has
no Repository stamp at all (as for bioconductor.org binaries, or very old
or source-installed packages), renv trusts the biocViews field. (#2128)

A new project setting, settings$bioconductor.enabled(), can be set to
FALSE to opt a project out of Bioconductor entirely. When disabled, renv
will not infer a Bioconductor source, activate Bioconductor repositories, or
write a Bioconductor entry into the lockfile. (#2128)

renv's internal DCF and properties readers now match their (ASCII)
regular expressions with useBytes = TRUE. This avoids forcing PCRE
into UTF mode, which could fail with "this version of PCRE is compiled
without UTF support" -- in some environments preventing renv from even
loading -- when R is linked against a PCRE library lacking UTF support
or left in a state where it believes UTF is unsupported.

renv::install(<package>, type = "source") once again installs from
source when a binary Posit Package Manager (PPM) repository is
configured. Previously, the dependency graph was resolved against the
un-transformed (binary) repository URL, so a binary package could be
installed even though source was requested. (#2303)

The presence of an rsconnect/ folder in a project is now treated as a
development dependency on the rsconnect package, rather than a runtime
dependency. This means rsconnect will no longer be automatically
recorded by renv::snapshot() unless the project actually uses it at
run time (or settings$snapshot.dev(TRUE) is set). (#2290)

renv::install() no longer treats a package as already installed when
its namespace is loaded from a path that is no longer on .libPaths()
(e.g. when a global ~/.Rprofile loads the package before renv
activates). Previously, install() would silently skip these packages
and snapshot() could not record them, leaving the project stuck.
(#2300)

On project load, renv now warns when one or more package namespaces
have already been loaded from a path outside the active library
paths. Such packages are not managed by renv and can cause
renv::status() and renv::snapshot() to report inconsistencies.
The check can be disabled via the namespaces.check config option
(or the RENV_CONFIG_NAMESPACES_CHECK environment variable). (#2300)