renv Files

renv::install() and renv::restore() with pak enabled can now handle packages hosted on a self-hosted GitLab instance. renv previously handed pak remotes of the form gitlab@<host>::<group>/<project>, which pak was unable to parse; renv now translates these into pkgdepends' own syntax, gitlab::https://<host>/<group>/<project>. GitLab sub-directories are likewise translated to pkgdepends' /-/<subdir> syntax. (#2180)

When a package fails to download, renv now reports the reason for the failure, rather than a generic "failed to download" message. For example, when the download destination within the renv root is not writable (as can happen with a misconfigured shared cache), the error now says so directly. (#2340)

Failed package downloads are now reported quietly when a later retrieval candidate succeeds -- for example, when a binary package fails to download, but the source fallback succeeds. If all candidates fail, the download output is still emitted, and download errors are no longer reported twice. (#1727)

renv::use() with pak enabled now honours the requested remotes, rather than installing the latest version of each package from the active repositories. Previously, a call like renv::use("generics@0.1.3") would install the current CRAN version of generics. renv::rebuild() and renv::repair() were affected in the same way. (#2341)

renv::remove() gains a prompt argument, and now asks for confirmation before removing packages from a library other than the project library -- for example, when called without an activated renv project, where the target library would be the user library. (#2331)

Removing a package record from the lockfile by setting it to NULL, e.g. with renv::record(list(dplyr = NULL)), is now documented. (#2331)

Package projects can now request that the package itself be included in the lockfile, by setting Config/renv/snapshot/include-self: TRUE in the package DESCRIPTION file. This can be useful when deploying a Shiny application that is developed as part of a package. See ?renv::snapshot for more details. (#2285)

renv::dependencies() now detects packages referenced via rlang::check_installed() and rlang::is_installed(). (#1936)

renv::dependencies() now infers the optional packages required by certain testthat functions; for example, skip_if_offline() implies a dependency on curl, and snapshot_review() implies dependencies on shiny and diffviewer. In addition, usage of the Junit reporter is now also detected in calls to test_check() and test_local(). (#1936)

renv::dependencies() now detects a dependency on the ragg package when the ragg_png graphics device is requested via knitr chunk options set in a document's YAML header. Previously, only calls of the form knitr::opts_chunk$set(dev = "ragg_png") in code chunks were detected. (#2311)

renv::install() with pak enabled no longer upgrades already-installed dependencies that are only pulled in transitively -- most visibly recommended packages such as cluster or Matrix, which previously could be rebuilt when installing an unrelated package. renv now passes upgrade = FALSE to pak, matching renv's own installer, while still forcing a (re)install of the packages you explicitly request. (#2329)

Internal DESCRIPTION reads that request a package by name now error when that package is not installed, rather than silently falling back to the DESCRIPTION in the current working directory. (#2327)

renv now guards against corrupted cache entries that contain the wrong package. Before installing a package from the cache, renv verifies that the cache entry's DESCRIPTION reports the expected package name; if it does not (for example, due to a concurrent write race on a shared cache), renv ignores the entry and reinstalls the package instead of installing the wrong one. renv::diagnostics() also reports any such cache entries. (#2322)

renv's file locks now record the host and process that own them. A lock held by a process that is still alive on the same machine is no longer treated as orphaned, even if its timestamp is stale (for example, when a large package copy onto a shared cache takes longer than the lock timeout and the watchdog is not refreshing the lock). This reduces the chance of a lock being stolen from a live process, which could otherwise corrupt a shared cache. (#2322)

renv::rehash() now reminds you to run renv::repair() when it moves packages within the active cache, since project libraries that still link to a package's previous cache location are left with broken links. The function's documentation has also been corrected: it no longer claims that links to the old locations are retained.

When renv::snapshot() aborts due to a pre-flight validation failure, the error now includes a summary of the problems that were detected (for example, the missing packages or unsatisfied dependencies). Previously these details were only printed to the console, so they could be lost when that output was not visible (such as when stdout is captured).

The new lockfile() function provides a generic entry point for creating an renv lockfile from a variety of sources. For example, lockfile(from = "manifest.json") converts a Posit Connect manifest.json file into a lockfile. Supply to to also write the result to disk, as in lockfile(from = "manifest.json", to = "renv.lock"). The set of supported sources may be expanded in future releases. (#2245)

renv::snapshot() gains a description parameter, which converts a package DESCRIPTION (provided either as a named list of fields, or as a path to a package directory or DESCRIPTION file) into a single lockfile record, without requiring the package to be installed. This allows tools like rsconnect to perform manifest-to-lockfile conversion using exported renv APIs. (#2250)

When resolving the dependencies of a pinned package version that is absent from the configured repositories' PACKAGES metadata and cannot be found via crandb (for example, when offline, when using an internal mirror that cannot reach crandb.r-pkg.org, or for non-CRAN packages), renv now downloads the archived source tarball for that version and reads its DESCRIPTION directly. This is authoritative wherever the package itself is reachable, and the downloaded tarball is reused by the subsequent retrieve step. As a last resort, if the archived tarball also cannot be read, renv falls back to the latest version's dependencies and warns, since those dependencies may differ from the pinned version's and could lead to an incorrect install order. (#2315)

Fixed a regression introduced in renv 1.2.0 where installing a package from the cellar (via install() or use()) failed to install that package's dependencies. The graph-based installer resolved cellar packages from metadata that omitted their Depends / Imports / LinkingTo fields; renv now reads the package's DESCRIPTION from the cellar archive so that its dependencies are discovered and installed. (#2313)

renv now infers some "implied" dependencies that cannot be discovered via static analysis because they are loaded indirectly at runtime by another package. For example, dplyr lazily loads dbplyr when working with a database backend, so dbplyr is now recorded when a project uses both dplyr and a DBI backend (e.g. RSQLite, RPostgres, duckdb). The rules are configurable via the renv.dependencies.implied R option; set it to an empty list to disable this inference entirely. (#2308)

renv::restore() gains a retry argument, controlling whether packages that fail to install successfully are retried with their latest available versions. This recovery was previously only offered via an interactive prompt; retry = TRUE now enables it without prompting (useful in non-interactive sessions such as CI), while retry = FALSE disables it entirely. (#1893)

renv no longer treats the mere presence of a biocViews field in a package's DESCRIPTION as proof that the package came from Bioconductor. Some CRAN packages declare biocViews, and Posit Package Manager can serve Bioconductor packages from a CRAN-like "R repository"; in both cases renv now uses the Repository field to decide where a package was obtained, so such packages are recorded as repository packages and restored from the repository they came from. Genuine Bioconductor packages are still recognized by their Repository stamp, including binaries served via r-universe (stamped with a https://bioc-*.r-universe.dev URL); and when a package has no Repository stamp at all (as for bioconductor.org binaries, or very old or source-installed packages), renv trusts the biocViews field. (#2128)

A new project setting, settings$bioconductor.enabled(), can be set to FALSE to opt a project out of Bioconductor entirely. When disabled, renv will not infer a Bioconductor source, activate Bioconductor repositories, or write a Bioconductor entry into the lockfile. (#2128)

renv's internal DCF and properties readers now match their (ASCII) regular expressions with useBytes = TRUE. This avoids forcing PCRE into UTF mode, which could fail with "this version of PCRE is compiled without UTF support" -- in some environments preventing renv from even loading -- when R is linked against a PCRE library lacking UTF support or left in a state where it believes UTF is unsupported.

renv::install(<package>, type = "source") once again installs from source when a binary Posit Package Manager (PPM) repository is configured. Previously, the dependency graph was resolved against the un-transformed (binary) repository URL, so a binary package could be installed even though source was requested. (#2303)

The presence of an rsconnect/ folder in a project is now treated as a development dependency on the rsconnect package, rather than a runtime dependency. This means rsconnect will no longer be automatically recorded by renv::snapshot() unless the project actually uses it at run time (or settings$snapshot.dev(TRUE) is set). (#2290)

renv::install() no longer treats a package as already installed when its namespace is loaded from a path that is no longer on .libPaths() (e.g. when a global ~/.Rprofile loads the package before renv activates). Previously, install() would silently skip these packages and snapshot() could not record them, leaving the project stuck. (#2300)

On project load, renv now warns when one or more package namespaces have already been loaded from a path outside the active library paths. Such packages are not managed by renv and can cause renv::status() and renv::snapshot() to report inconsistencies. The check can be disabled via the namespaces.check config option (or the RENV_CONFIG_NAMESPACES_CHECK environment variable). (#2300)