chore(deps): update dependency nbafrank/uvr to v0.4.6 #162

Merged
automation-bot merged 1 commit from renovate/nbafrank-uvr-0.x into main 2026-08-11 00:32:01 +00:00
Owner

This PR contains the following updates:

Package Update Change
nbafrank/uvr patch v0.4.5v0.4.6

Release Notes

nbafrank/uvr (nbafrank/uvr)

v0.4.6

Compare Source

Standalone scripts land: a .R file can now declare its own dependencies
in a header comment and run anywhere, with no project, manifest, or
lockfile — the first slice of F1 from the uv-parity roadmap, and the
feature that most distinguishes uvr from the alternatives. Alongside it:
faster warm syncs on every platform (Windows stops copying packages,
Linux source caching works at all for the first time), R installs you can
place where you want, and an install plan you can inspect before it runs.

Two adversarial reviews ran before this tag. One found that two features
in this very batch broke each other — script environments were diverted
by UVR_LIBRARY — which is fixed here and covered by a regression test.

  • A script's inline-header environment is no longer diverted by
    UVR_LIBRARY. The two features collided: the ephemeral environment is
    cache-owned, but the install inherited the override, so a user with
    UVR_LIBRARY exported — the people that feature exists for — had the
    script's declared packages installed into their shared library while R
    was pointed at the empty cache directory. The script then failed, and
    nothing pruned the packages left behind. Found by pre-tag review.

  • R package builds no longer fail on HPC clusters with module-provided
    BLAS/LAPACK
    (PR #​229, @​gladkia). R CMD INSTALL subprocesses replaced
    LD_LIBRARY_PATH with R's own lib dir, discarding the OpenBLAS/MKL/
    FlexiBLAS paths an environment-module system had put there — installs
    succeeded and then library() died on libRlapack.so: cannot open shared object file. The path is now prepended rather than replaced, in
    R CMD INSTALL and in the shared environment builder behind uvr run
    and uvr activate, and R_LD_LIBRARY_PATH is set so R's own
    byte-compilation children inherit it too — guarded on libR.so actually
    being present, so it can't suppress the ldpaths default that portable
    builds rely on to find their own libR.so.

  • Windows warm syncs no longer copy every package (#​247): cache hits
    now hardlink each file into the project library instead of copying its
    bytes. macOS has cloned (copy-on-write) and Linux has symlinked since
    v0.3; Windows was paying a full recursive copy on every sync because
    symlinks there need admin rights — hardlinks don't. Falls back to a copy
    when the cache and project sit on different volumes.

  • R version detection is memoized per process (#​246). A single sync asked
    the same R binary for its version several times over — find_all, the
    pin-mismatch check, and the IDE scaffolding each spawned R — and each ask
    is a full R startup, cheap locally but 0.3-0.5s on a container's shared
    I/O. Keyed on path, size and mtime, so an R replaced mid-run is a miss
    rather than a stale hit.

  • uvr sync --install-system-deps refreshes the package index first on
    managers that need it (apt-get, zypper, pacman, apk), passes zypper
    --gpg-auto-import-keys, and sets DEBIAN_FRONTEND=noninteractive for
    apt — fresh containers ship no synced metadata, an unimported repo key
    made --non-interactive zypper decline, and -y doesn't answer debconf.

  • Source-built packages cached on Linux are now found again by later
    syncs
    (#​237). The cache key hashed the binary-repo flavour into every
    entry it stored, but lookups probe source entries without one — so on
    any Linux host with a binary repo (a flavour), every package that
    installed from source landed in the cache under a key no lookup could
    produce, and was rebuilt from source on every warm sync, forever. The
    flavour is now part of the key only for binary entries, which is the
    rule lookups always assumed. Existing mis-keyed source entries were
    unreachable anyway and are simply superseded (uvr cache clean reclaims
    the orphans).

  • UVR_LIBRARY now applies to the whole project, not just uvr sync
    (#​97). Previously only sync honoured it as an install target, so setting
    it sent packages to a directory that uvr run, uvr activate, doctor
    and IDE sessions never looked at. All of them — including the .Rprofile
    snippet, which refreshes on the next sync — now resolve the library
    through the same rule: UVR_LIBRARY when set, else .uvr/library/.
    This is the machine-local escape hatch for projects living on slow
    network storage (Azure ML mapped drives and similar), matching
    UV_PROJECT_ENVIRONMENT / RENV_PATHS_LIBRARY / RV_LIBRARY_DIR.
    Pruning still never runs against an override target.

  • A CRAN mac binary failing to load under a non-CRAN R is now diagnosed
    as what it is
    (#​238). When a package's compiled code cannot load because
    it expects CRAN's R at /Library/Frameworks/R.framework (dlopen's
    "Library not loaded"), the hint now explains the CRAN-binary/Homebrew-R
    mismatch and both ways out — use CRAN R, or make the Fortran runtime
    findable to the loader. Previously this failure either got no hint at
    all or the "missing Fortran toolchain" one, which told users who already
    had a working gfortran to go install one.

  • uvr r install --install-dir <DIR> (#​89) installs R into a chosen
    r-versions directory for that one invocation, taking precedence over
    UVR_R_INSTALL_DIR the way uv's flags beat their env vars. The env var
    remains the way to make every command look there.

  • uvr sync -v shows the per-package install plan (#​205). Before
    anything compiles, -v expands the aggregate "Installing 83: 80 binary ·
    3 from source" into one row per package — name, version, cached/binary/
    pure-R/source, and the URL it resolved to — and names each binary-capable
    custom source behind the "Using N custom source(s)" line. An unexpected
    source build now explains itself up front instead of being
    reverse-engineered from uvr.lock afterwards. Default output is
    unchanged.

  • A script can carry its own dependencies and run anywhere (#​181). An
    .R file that opens with a # /// script# /// comment block listing
    package names now runs standalone — uvr run analysis.R in any directory,
    with no project, no uvr.toml and no setup. The packages are provisioned
    into an isolated ephemeral environment, cached and reused across runs of
    the same header, so sending someone the file is enough. This is the R
    analog of Python's PEP 723, and the first slice of it: plain package names
    only. Version constraints, Bioconductor and git sources (#​182), an r
    version pin (#​183), and uvr add --script (#​184) follow — a header using
    any of them is rejected or reported rather than quietly misread. A file
    may declare only one header block: a second one is a hard error, as in
    PEP 723, never a silent no-op. And because a headered script is by design
    a file you accept from someone else, header text is control-escaped
    before it appears in uvr's own warnings and errors, so a crafted header
    cannot smuggle ANSI sequences that repaint or forge diagnostics.

    Standalone means standalone: a headered script ignores the surrounding
    project's library, its R constraint, any .r-version pin walked up from
    the working directory, and the startup profile that would otherwise put
    the project library back on the search path. Without all four the same
    file would resolve differently depending on which directory it was run
    from, which is the one thing it exists to avoid. Scripts with no header
    are untouched.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
  • Automerge
    • Between 12:00 AM and 03:59 AM (* 0-3 * * *)

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [nbafrank/uvr](https://github.com/nbafrank/uvr) | patch | `v0.4.5` → `v0.4.6` | --- ### Release Notes <details> <summary>nbafrank/uvr (nbafrank/uvr)</summary> ### [`v0.4.6`](https://github.com/nbafrank/uvr/blob/HEAD/CHANGELOG.md#v046-2026-08-10) [Compare Source](https://github.com/nbafrank/uvr/compare/v0.4.5...v0.4.6) Standalone scripts land: a `.R` file can now declare its own dependencies in a header comment and run anywhere, with no project, manifest, or lockfile — the first slice of F1 from the uv-parity roadmap, and the feature that most distinguishes uvr from the alternatives. Alongside it: faster warm syncs on every platform (Windows stops copying packages, Linux source caching works at all for the first time), R installs you can place where you want, and an install plan you can inspect before it runs. Two adversarial reviews ran before this tag. One found that two features in this very batch broke each other — script environments were diverted by `UVR_LIBRARY` — which is fixed here and covered by a regression test. - A script's inline-header environment is no longer diverted by `UVR_LIBRARY`. The two features collided: the ephemeral environment is cache-owned, but the install inherited the override, so a user with `UVR_LIBRARY` exported — the people that feature exists for — had the script's declared packages installed into their shared library while R was pointed at the empty cache directory. The script then failed, and nothing pruned the packages left behind. Found by pre-tag review. - **R package builds no longer fail on HPC clusters with module-provided BLAS/LAPACK** (PR [#&#8203;229](https://github.com/nbafrank/uvr/issues/229), [@&#8203;gladkia](https://github.com/gladkia)). `R CMD INSTALL` subprocesses replaced `LD_LIBRARY_PATH` with R's own lib dir, discarding the OpenBLAS/MKL/ FlexiBLAS paths an environment-module system had put there — installs succeeded and then `library()` died on `libRlapack.so: cannot open shared object file`. The path is now prepended rather than replaced, in `R CMD INSTALL` and in the shared environment builder behind `uvr run` and `uvr activate`, and `R_LD_LIBRARY_PATH` is set so R's own byte-compilation children inherit it too — guarded on `libR.so` actually being present, so it can't suppress the `ldpaths` default that portable builds rely on to find their own `libR.so`. - **Windows warm syncs no longer copy every package** ([#&#8203;247](https://github.com/nbafrank/uvr/issues/247)): cache hits now hardlink each file into the project library instead of copying its bytes. macOS has cloned (copy-on-write) and Linux has symlinked since v0.3; Windows was paying a full recursive copy on every sync because symlinks there need admin rights — hardlinks don't. Falls back to a copy when the cache and project sit on different volumes. - R version detection is memoized per process ([#&#8203;246](https://github.com/nbafrank/uvr/issues/246)). A single sync asked the same R binary for its version several times over — `find_all`, the pin-mismatch check, and the IDE scaffolding each spawned R — and each ask is a full R startup, cheap locally but 0.3-0.5s on a container's shared I/O. Keyed on path, size and mtime, so an R replaced mid-run is a miss rather than a stale hit. - `uvr sync --install-system-deps` refreshes the package index first on managers that need it (apt-get, zypper, pacman, apk), passes zypper `--gpg-auto-import-keys`, and sets `DEBIAN_FRONTEND=noninteractive` for apt — fresh containers ship no synced metadata, an unimported repo key made `--non-interactive` zypper decline, and `-y` doesn't answer debconf. - **Source-built packages cached on Linux are now found again by later syncs** ([#&#8203;237](https://github.com/nbafrank/uvr/issues/237)). The cache key hashed the binary-repo flavour into every entry it stored, but lookups probe source entries without one — so on any Linux host with a binary repo (a flavour), every package that installed from source landed in the cache under a key no lookup could produce, and was rebuilt from source on every warm sync, forever. The flavour is now part of the key only for binary entries, which is the rule lookups always assumed. Existing mis-keyed source entries were unreachable anyway and are simply superseded (`uvr cache clean` reclaims the orphans). - **`UVR_LIBRARY` now applies to the whole project, not just `uvr sync`** ([#&#8203;97](https://github.com/nbafrank/uvr/issues/97)). Previously only sync honoured it as an install target, so setting it sent packages to a directory that `uvr run`, `uvr activate`, doctor and IDE sessions never looked at. All of them — including the `.Rprofile` snippet, which refreshes on the next sync — now resolve the library through the same rule: `UVR_LIBRARY` when set, else `.uvr/library/`. This is the machine-local escape hatch for projects living on slow network storage (Azure ML mapped drives and similar), matching `UV_PROJECT_ENVIRONMENT` / `RENV_PATHS_LIBRARY` / `RV_LIBRARY_DIR`. Pruning still never runs against an override target. - **A CRAN mac binary failing to load under a non-CRAN R is now diagnosed as what it is** ([#&#8203;238](https://github.com/nbafrank/uvr/issues/238)). When a package's compiled code cannot load because it expects CRAN's R at `/Library/Frameworks/R.framework` (dlopen's "Library not loaded"), the hint now explains the CRAN-binary/Homebrew-R mismatch and both ways out — use CRAN R, or make the Fortran runtime findable to the loader. Previously this failure either got no hint at all or the "missing Fortran toolchain" one, which told users who already had a working gfortran to go install one. - **`uvr r install --install-dir <DIR>`** ([#&#8203;89](https://github.com/nbafrank/uvr/issues/89)) installs R into a chosen r-versions directory for that one invocation, taking precedence over `UVR_R_INSTALL_DIR` the way uv's flags beat their env vars. The env var remains the way to make every command look there. - **`uvr sync -v` shows the per-package install plan** ([#&#8203;205](https://github.com/nbafrank/uvr/issues/205)). Before anything compiles, `-v` expands the aggregate "Installing 83: 80 binary · 3 from source" into one row per package — name, version, cached/binary/ pure-R/source, and the URL it resolved to — and names each binary-capable custom source behind the "Using N custom source(s)" line. An unexpected source build now explains itself up front instead of being reverse-engineered from `uvr.lock` afterwards. Default output is unchanged. - **A script can carry its own dependencies and run anywhere** ([#&#8203;181](https://github.com/nbafrank/uvr/issues/181)). An `.R` file that opens with a `# /// script` … `# ///` comment block listing package names now runs standalone — `uvr run analysis.R` in any directory, with no project, no `uvr.toml` and no setup. The packages are provisioned into an isolated ephemeral environment, cached and reused across runs of the same header, so sending someone the file is enough. This is the R analog of Python's PEP 723, and the first slice of it: plain package names only. Version constraints, Bioconductor and git sources ([#&#8203;182](https://github.com/nbafrank/uvr/issues/182)), an `r` version pin ([#&#8203;183](https://github.com/nbafrank/uvr/issues/183)), and `uvr add --script` ([#&#8203;184](https://github.com/nbafrank/uvr/issues/184)) follow — a header using any of them is rejected or reported rather than quietly misread. A file may declare only one header block: a second one is a hard error, as in PEP 723, never a silent no-op. And because a headered script is by design a file you accept from someone else, header text is control-escaped before it appears in uvr's own warnings and errors, so a crafted header cannot smuggle ANSI sequences that repaint or forge diagnostics. Standalone means standalone: a headered script ignores the surrounding project's library, its R constraint, any `.r-version` pin walked up from the working directory, and the startup profile that would otherwise put the project library back on the search path. Without all four the same file would resolve differently depending on which directory it was run from, which is the one thing it exists to avoid. Scripts with no header are untouched. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNDUuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI0NS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
chore(deps): update dependency nbafrank/uvr to v0.4.6
Some checks failed
ci/crow/cron/process-updates/13 Pipeline was successful
ci/crow/cron/process-updates/14 Pipeline was successful
ci/crow/cron/process-updates/15 Pipeline was successful
ci/crow/cron/process-updates/16 Pipeline was successful
ci/crow/cron/process-updates/18 Pipeline was successful
ci/crow/cron/process-updates/11 Pipeline was successful
ci/crow/cron/process-updates/17 Pipeline was successful
ci/crow/cron/process-updates/12 Pipeline was successful
ci/crow/cron/process-updates/6 Pipeline was successful
ci/crow/cron/process-updates/5 Pipeline was successful
ci/crow/cron/process-updates/1 Pipeline was successful
ci/crow/cron/process-updates/2 Pipeline was successful
ci/crow/cron/process-updates/7 Pipeline was successful
ci/crow/cron/process-updates/8 Pipeline was successful
ci/crow/manual/weekly-rebuild-missing/6 Pipeline was canceled
ci/crow/manual/weekly-rebuild-missing/5 Pipeline was canceled
ci/crow/cron/process-updates/9 Pipeline was successful
ci/crow/cron/process-updates/3 Pipeline was successful
ci/crow/cron/process-updates/10 Pipeline was successful
ci/crow/cron/process-updates/4 Pipeline was successful
caf3276fb9
automation-bot scheduled this pull request to auto merge when all checks succeed 2026-08-11 00:32:00 +00:00
Sign in to join this conversation.
No reviewers
No labels
No milestone
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
devxy/build-cran-binaries!162
No description provided.