chore(deps): update dependency nbafrank/uvr to v0.4.7 #229

Merged

automation-bot merged 1 commit from renovate/nbafrank-uvr-0.x into main 2026-10-11 00:32:46 +00:00

Conversation 0 Commits 1 Files changed 1 +1 -1

automation-bot commented 2026-10-11 00:32:44 +00:00

Owner

• Copy link
• Copy Markdown

This PR contains the following updates:

Package	Update	Change
nbafrank/uvr	patch	v0.4.6 → v0.4.7

---

Release Notes

nbafrank/uvr (nbafrank/uvr)

v0.4.7

Compare Source

Private and non-CRAN code becomes a first-class dependency: packages from
authenticated repositories, from any git host, and from a tarball URL, with
one credential resolver (environment variables, then ~/.netrc) behind all
of them. Lockfiles get stricter in the useful direction: uvr sync --frozen
no longer breaks when CRAN publishes something new, git dependencies install
from their locked commit, and uvr add/uvr remove stop rewriting your
uvr.toml. IDE setup is now opt-in, with an explicit unattended mode for CI.

Three adversarial reviews ran before this tag. They found that a git host's
token could reach a lookalike host (and that the all-hosts GitLab/Forgejo
tokens went to any host a project named), that re-locking could silently
accept a changed URL tarball, and that --frozen rejected inline git refs.
All are fixed here.

Two changes may need action:

• Self-hosted GitLab/Forgejo: use the per-host token variable. The
  all-hosts UVR_GITLAB_TOKEN / UVR_FORGEJO_TOKEN now go only to
  gitlab.com / codeberg.org, and a - in a host name is now __ in the
  variable name. uvr warns and prints the variable to set.

• r_version = "4.5" (no operator) now pins R 4.5.x, as .r-version
  and uvr r use always did. Write ">=4.5" for a floor.

• Verify installed and cached generic Git package provenance before reuse, including same-version content or origin changes. Frozen sync validates manifest inputs locally and restores the locked commit without following remote branch changes.

• A bare r_version pins R (#​320). r_version = "4.5.3" in uvr.toml
  used to be read as the semver caret ^4.5.3, so uvr run picked the
  newest R (4.6.0) and then warned that it didn't match the pin, telling you
  to install a version that was already installed. A bare version now
  means what it means in .r-version and uvr r use: "4.5.3" is exactly
  R 4.5.3, and "4.5" is the newest installed 4.5.x. Write ">=4.5" or
  "^4.5" for a range. uvr run --r-version 4.5.3 follows the same rule,
  and so does the --frozen check of the locked R. uvr import now writes
  the R from renv.lock as a floor (">=4.2.1"), because renv records the
  R a lock was made with, not one the project requires.

• Pre-release review fixes.

  • uvr lock without --upgrade, and uvr add of another package, now
    refuse a URL tarball whose file changed since uvr.lock was written,
    instead of quietly recording the new checksum. Only uvr lock --upgrade
    accepts it.
  • uvr sync --frozen accepts git = "git::<url>@&#8203;<ref>" written inline. It
    used to reject every such lock as not matching its Git dependency.
  • A url = dependency with a user:password@ part is rejected, because
    the secret would be written into uvr.toml and uvr.lock.
  • A [[sources]] credential is no longer sent over plain http://, except
    to localhost; uvr warns instead.
  • UVR_GITLAB_TOKEN* and UVR_FORGEJO_TOKEN* are kept out of
    R CMD INSTALL, like the other uvr credentials.
  • Breaking, for self-hosted GitLab and Forgejo. A git host's token can
    no longer reach a different host. A - in a host name is now __ in
    its token variable (my-gitlab.example → UVR_GITLAB_TOKEN_MY__GITLAB_EXAMPLE).
    Before, - and . were both _, so a project that named
    git-corp.com received the token set for git.corp.com. The all-hosts
    UVR_GITLAB_TOKEN and UVR_FORGEJO_TOKEN now go only to gitlab.com
    and codeberg.org; before, they went to any host a dependency named. A
    variable under its old name, or an all-hosts token that a host no
    longer gets, produces a warning with the variable to set instead.
  • The first uvr add in a project writes a standard [dependencies]
    table, not an inline dependencies = { … } above [project].
  • A CRLF uvr.toml stays CRLF when uvr add or uvr remove edits it.

• Positron settings name the project's R (#​321). uvr init, sync and
  import now bind .vscode/settings.json to the R that uvr run resolves
  (the .r-version pin, then the uvr.toml r_version) instead of the
  newest installed R. If no installed R satisfies the project, the settings
  are left alone with a hint, rather than pointing at a different R. The
  managed-R check also honours UVR_R_INSTALL_DIR now.

• IDE config is now opt-in; CI mode is explicit (#​176, #​206).
  uvr init/sync/import no longer assume an RStudio/Positron workflow:
  .vscode/settings.json and IDE-oriented hints are only produced when
  Positron is detected (POSITRON=1) or forced with --ide=positron (now
  scoped to init/sync/import).
  --no-ide suppresses them, --no-companion (UVR_NO_COMPANION=1) skips
  the injected companion R package, and --unattended (UVR_UNATTENDED=1)
  disables all of the above and every working-tree write (.Rprofile,
  .gitignore, activation shims) so a checked-out repository stays
  byte-identical. uvr sync --frozen runs its staleness check before writing
  any scaffolding, so a stale lockfile fails without dirtying the checkout.
  uvr init --bare is the persistent form for interactive
  use: uvr.toml, .uvr/library/, and a protective .gitignore, persisted
  in [project] bare = true.

• uvr scan now detects box::use() imports. Package declarations
  (box::use(dplyr[filter]), box::use(gg = ggplot2)) are discovered;
  local module paths (box::use(./mod), box::use(prefix/mod)) are
  ignored.

• Packages from any git host (#​190). A dependency can now name a git
  repository by its clone URL: uvr add git::https://git.example.com/team/pkg.git@v1.0,
  or pkg = { git = "git::<url>", rev = "v1.0" } in uvr.toml. This covers
  Bitbucket, a self-hosted GitLab or Gitea, and company git servers. uvr runs
  git to find and fetch the commit, locks it (source = "git:<url>",
  checksum = "git:<sha>"), installs it from source, and keeps it in the
  download cache. https://, ssh:// and user@host:path URLs work;
  http:// and file:// work with a warning. A private https repository
  takes UVR_GIT_TOKEN_<HOST> (with an optional UVR_GIT_USER_<HOST>) or a
  ~/.netrc entry; without one, git uses its own credential helpers or ssh
  keys. uvr doctor now shows whether git is installed, and uvr export
  writes these packages as renv git remotes.

• One credential path for GitHub, GitLab and Forgejo (#​187). The three
  git hosts now get their tokens from the same resolver as [[sources]]
  repositories, with the same variables and order as before. Private GitHub
  dependencies now install: uvr also sends the token with the tarball
  download, not only at lock time. A git host's token now goes only to URLs
  on that host. Before, uvr sync could send a GitLab or Forgejo token to a
  P3M or custom-source binary URL for a package with the same name. If a
  host refuses a ~/.netrc password, uvr shows a warning and continues
  without credentials, so an old entry does not break public repositories.

• Credentials from ~/.netrc (#​186). If no UVR_REPO_* variable is set
  for a [[sources]] repository, uvr uses the ~/.netrc entry for its host
  (HTTP basic auth). GitHub, GitLab and Forgejo dependencies also use the
  entry's password as their access token when their token variables are
  not set. An environment credential always has precedence. NETRC gives a
  different file. On Unix, uvr shows a warning and ignores a netrc file
  that other users can access. uvr never uses a default entry. The
  401/403 message now also names the netrc entry to add.

• Install from authenticated repositories (#​185). A [[sources]]
  repository (a private Posit Package Manager, an internal mirror) can now
  require credentials. uvr reads them from the environment, keyed by the
  source name: UVR_REPO_TOKEN_<NAME> for a bearer token, or
  UVR_REPO_USER_<NAME> and UVR_REPO_PASSWORD_<NAME> for HTTP basic auth,
  so uvr.toml never holds a secret. uvr sends the credential with the index
  request and with each package download, but only to URLs under that
  repository. A 401/403 names the repository and the variables to set.
  Credentials never show in output, -v included, and user:pass@ URLs are
  redacted. uvr add --source now refuses a URL that has credentials in it.

• Verify installed and cached URL tarball package provenance before reuse, including same-version content or origin changes. Downloads are verified against the locked checksum; frozen sync checks the declared URL locally.

• Depend on a source tarball by URL (#​189). uvr add https://…/pkg_1.2.0.tar.gz records pkg = { url = "…" } in uvr.toml;
  the lockfile pins the URL and a sha256 checksum (source = "url"), and
  uvr sync installs that exact file from source, never a same-named binary.
  If the file changes, sync fails with both checksums and asks you to run
  uvr lock --upgrade. A URL that is not an R source package (a web page, a built
  binary, a tarball without one top-level package directory) is rejected
  when you add or lock it. uvr export writes these as renv URL remotes.

• Frozen sync checks the manifest locally (#​305). New lockfiles record a
  fingerprint of resolution inputs, so upstream releases cannot make an
  unchanged lock fail in CI. Graph completeness and development flags are also
  checked. Older CRAN/Bioconductor locks get a local dependency check; older
  Git/custom-repository locks need a one-time uvr lock migration. Plain
  uvr lock reuses the entire resolution when its inputs match; changed inputs
  trigger a fresh resolution. Use --upgrade to refresh unchanged inputs.

• Add and remove preserve comments and other tools' manifest metadata
  (#​306), including [project] version and [tool.*] tables.

• Git packages stay tied to their pinned source (#​300). Sync no longer
  substitutes a same-name registry binary for a GitHub, GitLab, or Forgejo
  dependency, and it checks installed and cached packages against the commit.

• Distro suite maintenance: refreshed the Alpine 3.21/3.22 image versions.

• macOS: the OpenMP shim now reaches CRAN's own R, not just uvr-managed
  installs (#​261). uvr skipped the shim for a system R on the assumption
  that CRAN's framework build links libomp itself. It does not: libR.dylib
  carries no libomp load command and SHLIB_OPENMP_CFLAGS is empty, so
  P3M binaries built with -fopenmp that don't link the runtime by absolute
  path (mgcv 1.9-4 among them, hence anything depending on it) failed with
  symbol not found in flat namespace '___kmpc_barrier', and the
  unconditional R_PROFILE_USER=/dev/null at install time removed the
  .Rprofile workaround too. Rather than editing an R it does not own, uvr
  now writes its site profile to ~/.uvr/etc/Rprofile.site and points
  R_PROFILE at it per invocation, for uvr run, uvr activate (restored
  on deactivate), and R CMD INSTALL's child sessions. The profile first
  sources the site profile it displaces ($R_HOME/etc/Rprofile.site, or a
  user's own R_PROFILE, carried in UVR_SITE_PROFILE_ORIG), so nothing is
  shadowed. Verified against a shim-less R: P3M's mgcv 1.9-4 fails before and
  loads after, with the chained profile's options still visible. R --vanilla
  remains the documented gap. Reported with a full otool diagnosis by
  @​remlapmot, with @​gdevenyi confirming the install-time half from the code.

• uvr r install rewrites the stale build-time R_HOME_DIR in the
  bin/R wrapper to the installation's real path (#​271). The portable
  builds leave the build machine's path (a /Library/Frameworks/...
  framework directory on macOS) on the wrapper's first assignment and only
  recompute it at runtime, so tools that read the wrapper as text resolved
  the interpreter to an R that isn't there — Positron either failed to
  start uvr-managed R or silently launched a different version against the
  project's library. The rewrite is inert for shell execution (the runtime
  override recomputes the same value) and only corrects what static
  readers see. Applies to new installs; refresh an existing version with
  uvr r uninstall <ver> && uvr r install <ver>. Reported with a
  verified one-line diagnosis by @​Felixmil.

• GitHub dependencies can select an R package in a repository
  subdirectory, directly or through transitive DESCRIPTION Remotes: (#​244).
  Direct declarations use
  uvr add 'owner/repo[@​revision]#subdirectory=path'; transitive declarations
  accept renv/devtools slash and colon forms. Repository, requested revision,
  exact commit, and package directory remain separate identities through the
  lock and install paths. Remote traversal is source-chained: only packages
  already reached through a manifest Git source may introduce another remote,
  while registry packages cannot inject URLs. Bound aliases and nested targets
  fail closed instead of falling back to CRAN or the repository root. Cache,
  provenance, frozen sync, and renv RemoteSha/RemoteSubdir handling apply to
  direct and transitive packages alike.
  One deliberate tightening rides along: a GitLab/Forgejo spec with a
  bare trailing @ (or a /-/ path segment) is now rejected at parse
  time instead of being read as "no ref" — cross-provider hardening,
  not a regression.

• Full docs claim audit. Every checkable factual claim in the README
  and the website was verified against primary sources (the tools' own
  docs and source, our own code and CLI). Fixed beyond the earlier
  Rationale pass: the sysreqs section still credited the r-hub sysreqs
  API (uvr uses the vendored r-system-requirements rules plus Posit's
  sysreqs API, across apt/dnf/zypper/apk); the "From R" install snippet
  was uninstallable as written (uvr-r is not on CRAN — now
  pak::pak("nbafrank/uvr-r")); renv's "run scripts" cell was wrong in
  both feature matrices (renv::run() exists); the rig admin footnote
  now cites rig's own FAQ (no admin, period — not just Windows); the
  site claimed an ~8 MB binary (it is ~12 MB); the uvr doctor example
  was refreshed to current output; uvr self-update is documented under
  its canonical name uvr upgrade. Verified-as-written and left alone:
  install script behavior, AUR packages, platform table, glibc/musl
  build channels, activation docs, standalone-script docs, all remaining
  matrix cells.

• Corrected false claims in the docs, flagged by r/rstats.
  The README's Rationale said renv installs are "slow and require
  compilation on Linux" (mirror-dependent, not true with a binary repo
  like P3M — our own benchmark shows it), said pak has "no lockfile"
  (pak::lockfile_create() exists, and our own feature matrix said Y),
  and the website's comparison table still had rv's column from before
  PR #​254 (no rv run, no sysdeps, no CI mode). All fixed.

• The website's benchmark numbers were invalid and are replaced.
  bench.sh pointed every R tool at P3M's source-only path
  (p3m.dev/cran/latest), so in the Linux container install.packages
  and pak compiled everything from source (865s / 414s for tidyverse)
  while uvr used binaries — that is not a comparison, and the "142x"
  headline built on it was wrong. The script now uses the
  __linux__/<codename> binary path plus an R User-Agent on Linux, and
  the site now shows the corrected container run (cold tier: uvr 10.4s
  vs install.packages 29.2s for tidyverse — 2.8x, not 142x; warm runs
  are far faster still). The same fix made the pathological pak and
  warm-sync numbers from #​235/#​237 disappear, so those were likely the
  mirror bug too.

• --install-system-deps now runs the setup commands the sysreqs rules
  carry, so it works on distros where the packages do not exist until a
  repository is enabled.
  63 of the 131 vendored rule files have a pre_install and 2 have a
  post_install, and uvr dropped all of them: on Rocky 9 it tried to
  install gdal3.4-devel from repos that were never enabled, and rJava
  never got its R CMD javareconf.
  pre_install now runs before the batched package install and
  post_install after, both only when something is actually missing, so a
  fully provisioned machine does not re-enable EPEL on every sync.
  Nothing runs without --install-system-deps / UVR_INSTALL_SYSREQS=1.

• The consent block says where each root command comes from and what it
  does.
  These are shell strings run as root, and two of them are worth reading
  before approving: they arrive either from uvr's vendored
  r-system-requirements snapshot or from Posit's API fetched during that
  sync, and some of them fetch and execute remote code, install from a
  URL, disable signature checking, or add a third-party repository.
  Each command is now listed with both, on stderr alongside the prompt and
  unconditionally, so redirecting stdout to a build log cannot separate
  the consent from what it covers.
  The block also states that an unannotated command is one uvr matched no
  pattern in rather than one it vetted.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [nbafrank/uvr](https://github.com/nbafrank/uvr) | patch | `v0.4.6` → `v0.4.7` | --- ### Release Notes <details> <summary>nbafrank/uvr (nbafrank/uvr)</summary> ### [`v0.4.7`](https://github.com/nbafrank/uvr/blob/HEAD/CHANGELOG.md#v047-2026-10-08) [Compare Source](https://github.com/nbafrank/uvr/compare/v0.4.6...v0.4.7) Private and non-CRAN code becomes a first-class dependency: packages from authenticated repositories, from any git host, and from a tarball URL, with one credential resolver (environment variables, then `~/.netrc`) behind all of them. Lockfiles get stricter in the useful direction: `uvr sync --frozen` no longer breaks when CRAN publishes something new, git dependencies install from their locked commit, and `uvr add`/`uvr remove` stop rewriting your `uvr.toml`. IDE setup is now opt-in, with an explicit unattended mode for CI. Three adversarial reviews ran before this tag. They found that a git host's token could reach a lookalike host (and that the all-hosts GitLab/Forgejo tokens went to any host a project named), that re-locking could silently accept a changed URL tarball, and that `--frozen` rejected inline git refs. All are fixed here. Two changes may need action: - **Self-hosted GitLab/Forgejo:** use the per-host token variable. The all-hosts `UVR_GITLAB_TOKEN` / `UVR_FORGEJO_TOKEN` now go only to `gitlab.com` / `codeberg.org`, and a `-` in a host name is now `__` in the variable name. uvr warns and prints the variable to set. - **`r_version = "4.5"` (no operator) now pins R 4.5.x**, as `.r-version` and `uvr r use` always did. Write `">=4.5"` for a floor. - Verify installed and cached generic Git package provenance before reuse, including same-version content or origin changes. Frozen sync validates manifest inputs locally and restores the locked commit without following remote branch changes. - **A bare `r_version` pins R** ([#&#8203;320](https://github.com/nbafrank/uvr/issues/320)). `r_version = "4.5.3"` in `uvr.toml` used to be read as the semver caret `^4.5.3`, so `uvr run` picked the newest R (4.6.0) and then warned that it didn't match the pin, telling you to install a version that was already installed. A bare version now means what it means in `.r-version` and `uvr r use`: `"4.5.3"` is exactly R 4.5.3, and `"4.5"` is the newest installed 4.5.x. Write `">=4.5"` or `"^4.5"` for a range. `uvr run --r-version 4.5.3` follows the same rule, and so does the `--frozen` check of the locked R. `uvr import` now writes the R from `renv.lock` as a floor (`">=4.2.1"`), because renv records the R a lock was made with, not one the project requires. - **Pre-release review fixes.** - `uvr lock` without `--upgrade`, and `uvr add` of another package, now refuse a URL tarball whose file changed since `uvr.lock` was written, instead of quietly recording the new checksum. Only `uvr lock --upgrade` accepts it. - `uvr sync --frozen` accepts `git = "git::<url>@&#8203;<ref>"` written inline. It used to reject every such lock as not matching its Git dependency. - A `url =` dependency with a `user:password@` part is rejected, because the secret would be written into `uvr.toml` and `uvr.lock`. - A `[[sources]]` credential is no longer sent over plain `http://`, except to `localhost`; uvr warns instead. - `UVR_GITLAB_TOKEN*` and `UVR_FORGEJO_TOKEN*` are kept out of `R CMD INSTALL`, like the other uvr credentials. - **Breaking, for self-hosted GitLab and Forgejo.** A git host's token can no longer reach a different host. A `-` in a host name is now `__` in its token variable (`my-gitlab.example` → `UVR_GITLAB_TOKEN_MY__GITLAB_EXAMPLE`). Before, `-` and `.` were both `_`, so a project that named `git-corp.com` received the token set for `git.corp.com`. The all-hosts `UVR_GITLAB_TOKEN` and `UVR_FORGEJO_TOKEN` now go only to `gitlab.com` and `codeberg.org`; before, they went to any host a dependency named. A variable under its old name, or an all-hosts token that a host no longer gets, produces a warning with the variable to set instead. - The first `uvr add` in a project writes a standard `[dependencies]` table, not an inline `dependencies = { … }` above `[project]`. - A CRLF `uvr.toml` stays CRLF when `uvr add` or `uvr remove` edits it. - **Positron settings name the project's R** ([#&#8203;321](https://github.com/nbafrank/uvr/issues/321)). `uvr init`, `sync` and `import` now bind `.vscode/settings.json` to the R that `uvr run` resolves (the `.r-version` pin, then the `uvr.toml` `r_version`) instead of the newest installed R. If no installed R satisfies the project, the settings are left alone with a hint, rather than pointing at a different R. The managed-R check also honours `UVR_R_INSTALL_DIR` now. - **IDE config is now opt-in; CI mode is explicit** ([#&#8203;176](https://github.com/nbafrank/uvr/issues/176), [#&#8203;206](https://github.com/nbafrank/uvr/issues/206)). `uvr init`/`sync`/`import` no longer assume an RStudio/Positron workflow: `.vscode/settings.json` and IDE-oriented hints are only produced when Positron is detected (`POSITRON=1`) or forced with `--ide=positron` (now scoped to `init`/`sync`/`import`). `--no-ide` suppresses them, `--no-companion` (`UVR_NO_COMPANION=1`) skips the injected companion R package, and `--unattended` (`UVR_UNATTENDED=1`) disables all of the above *and* every working-tree write (`.Rprofile`, `.gitignore`, activation shims) so a checked-out repository stays byte-identical. `uvr sync --frozen` runs its staleness check before writing any scaffolding, so a stale lockfile fails without dirtying the checkout. `uvr init --bare` is the persistent form for interactive use: `uvr.toml`, `.uvr/library/`, and a protective `.gitignore`, persisted in `[project] bare = true`. - **`uvr scan` now detects `box::use()` imports.** Package declarations (`box::use(dplyr[filter])`, `box::use(gg = ggplot2)`) are discovered; local module paths (`box::use(./mod)`, `box::use(prefix/mod)`) are ignored. - **Packages from any git host** ([#&#8203;190](https://github.com/nbafrank/uvr/issues/190)). A dependency can now name a git repository by its clone URL: `uvr add git::https://git.example.com/team/pkg.git@v1.0`, or `pkg = { git = "git::<url>", rev = "v1.0" }` in `uvr.toml`. This covers Bitbucket, a self-hosted GitLab or Gitea, and company git servers. uvr runs `git` to find and fetch the commit, locks it (`source = "git:<url>"`, `checksum = "git:<sha>"`), installs it from source, and keeps it in the download cache. `https://`, `ssh://` and `user@host:path` URLs work; `http://` and `file://` work with a warning. A private https repository takes `UVR_GIT_TOKEN_<HOST>` (with an optional `UVR_GIT_USER_<HOST>`) or a `~/.netrc` entry; without one, git uses its own credential helpers or ssh keys. `uvr doctor` now shows whether git is installed, and `uvr export` writes these packages as renv `git` remotes. - **One credential path for GitHub, GitLab and Forgejo** ([#&#8203;187](https://github.com/nbafrank/uvr/issues/187)). The three git hosts now get their tokens from the same resolver as `[[sources]]` repositories, with the same variables and order as before. Private GitHub dependencies now install: uvr also sends the token with the tarball download, not only at lock time. A git host's token now goes only to URLs on that host. Before, `uvr sync` could send a GitLab or Forgejo token to a P3M or custom-source binary URL for a package with the same name. If a host refuses a `~/.netrc` password, uvr shows a warning and continues without credentials, so an old entry does not break public repositories. - **Credentials from `~/.netrc`** ([#&#8203;186](https://github.com/nbafrank/uvr/issues/186)). If no `UVR_REPO_*` variable is set for a `[[sources]]` repository, uvr uses the `~/.netrc` entry for its host (HTTP basic auth). GitHub, GitLab and Forgejo dependencies also use the entry's password as their access token when their token variables are not set. An environment credential always has precedence. `NETRC` gives a different file. On Unix, uvr shows a warning and ignores a netrc file that other users can access. uvr never uses a `default` entry. The `401`/`403` message now also names the netrc entry to add. - **Install from authenticated repositories** ([#&#8203;185](https://github.com/nbafrank/uvr/issues/185)). A `[[sources]]` repository (a private Posit Package Manager, an internal mirror) can now require credentials. uvr reads them from the environment, keyed by the source name: `UVR_REPO_TOKEN_<NAME>` for a bearer token, or `UVR_REPO_USER_<NAME>` and `UVR_REPO_PASSWORD_<NAME>` for HTTP basic auth, so `uvr.toml` never holds a secret. uvr sends the credential with the index request and with each package download, but only to URLs under that repository. A `401`/`403` names the repository and the variables to set. Credentials never show in output, `-v` included, and `user:pass@` URLs are redacted. `uvr add --source` now refuses a URL that has credentials in it. - Verify installed and cached URL tarball package provenance before reuse, including same-version content or origin changes. Downloads are verified against the locked checksum; frozen sync checks the declared URL locally. - **Depend on a source tarball by URL** ([#&#8203;189](https://github.com/nbafrank/uvr/issues/189)). `uvr add https://…/pkg_1.2.0.tar.gz` records `pkg = { url = "…" }` in `uvr.toml`; the lockfile pins the URL and a `sha256` checksum (`source = "url"`), and `uvr sync` installs that exact file from source, never a same-named binary. If the file changes, sync fails with both checksums and asks you to run `uvr lock --upgrade`. A URL that is not an R source package (a web page, a built binary, a tarball without one top-level package directory) is rejected when you add or lock it. `uvr export` writes these as renv `URL` remotes. - **Frozen sync checks the manifest locally** ([#&#8203;305](https://github.com/nbafrank/uvr/issues/305)). New lockfiles record a fingerprint of resolution inputs, so upstream releases cannot make an unchanged lock fail in CI. Graph completeness and development flags are also checked. Older CRAN/Bioconductor locks get a local dependency check; older Git/custom-repository locks need a one-time `uvr lock` migration. Plain `uvr lock` reuses the entire resolution when its inputs match; changed inputs trigger a fresh resolution. Use `--upgrade` to refresh unchanged inputs. - **Add and remove preserve comments and other tools' manifest metadata** ([#&#8203;306](https://github.com/nbafrank/uvr/issues/306)), including `[project] version` and `[tool.*]` tables. - **Git packages stay tied to their pinned source** ([#&#8203;300](https://github.com/nbafrank/uvr/issues/300)). Sync no longer substitutes a same-name registry binary for a GitHub, GitLab, or Forgejo dependency, and it checks installed and cached packages against the commit. - **Distro suite maintenance:** refreshed the Alpine 3.21/3.22 image versions. - **macOS: the OpenMP shim now reaches CRAN's own R, not just uvr-managed installs** ([#&#8203;261](https://github.com/nbafrank/uvr/issues/261)). uvr skipped the shim for a system R on the assumption that CRAN's framework build links `libomp` itself. It does not: `libR.dylib` carries no `libomp` load command and `SHLIB_OPENMP_CFLAGS` is empty, so P3M binaries built with `-fopenmp` that don't link the runtime by absolute path (mgcv 1.9-4 among them, hence anything depending on it) failed with `symbol not found in flat namespace '___kmpc_barrier'`, and the unconditional `R_PROFILE_USER=/dev/null` at install time removed the `.Rprofile` workaround too. Rather than editing an R it does not own, uvr now writes its site profile to `~/.uvr/etc/Rprofile.site` and points `R_PROFILE` at it per invocation, for `uvr run`, `uvr activate` (restored on `deactivate`), and `R CMD INSTALL`'s child sessions. The profile first sources the site profile it displaces (`$R_HOME/etc/Rprofile.site`, or a user's own `R_PROFILE`, carried in `UVR_SITE_PROFILE_ORIG`), so nothing is shadowed. Verified against a shim-less R: P3M's mgcv 1.9-4 fails before and loads after, with the chained profile's options still visible. `R --vanilla` remains the documented gap. Reported with a full `otool` diagnosis by [@&#8203;remlapmot](https://github.com/remlapmot), with [@&#8203;gdevenyi](https://github.com/gdevenyi) confirming the install-time half from the code. - **`uvr r install` rewrites the stale build-time `R_HOME_DIR` in the `bin/R` wrapper to the installation's real path** ([#&#8203;271](https://github.com/nbafrank/uvr/issues/271)). The portable builds leave the build machine's path (a `/Library/Frameworks/...` framework directory on macOS) on the wrapper's first assignment and only recompute it at runtime, so tools that read the wrapper as text resolved the interpreter to an R that isn't there — Positron either failed to start uvr-managed R or silently launched a different version against the project's library. The rewrite is inert for shell execution (the runtime override recomputes the same value) and only corrects what static readers see. Applies to new installs; refresh an existing version with `uvr r uninstall <ver> && uvr r install <ver>`. Reported with a verified one-line diagnosis by [@&#8203;Felixmil](https://github.com/Felixmil). - **GitHub dependencies can select an R package in a repository subdirectory, directly or through transitive DESCRIPTION `Remotes:`** ([#&#8203;244](https://github.com/nbafrank/uvr/issues/244)). Direct declarations use `uvr add 'owner/repo[@&#8203;revision]#subdirectory=path'`; transitive declarations accept renv/devtools slash and colon forms. Repository, requested revision, exact commit, and package directory remain separate identities through the lock and install paths. Remote traversal is source-chained: only packages already reached through a manifest Git source may introduce another remote, while registry packages cannot inject URLs. Bound aliases and nested targets fail closed instead of falling back to CRAN or the repository root. Cache, provenance, frozen sync, and renv `RemoteSha`/`RemoteSubdir` handling apply to direct and transitive packages alike. One deliberate tightening rides along: a GitLab/Forgejo spec with a bare trailing `@` (or a `/-/` path segment) is now rejected at parse time instead of being read as "no ref" — cross-provider hardening, not a regression. - **Full docs claim audit.** Every checkable factual claim in the README and the website was verified against primary sources (the tools' own docs and source, our own code and CLI). Fixed beyond the earlier Rationale pass: the sysreqs section still credited the r-hub sysreqs API (uvr uses the vendored r-system-requirements rules plus Posit's sysreqs API, across apt/dnf/zypper/apk); the "From R" install snippet was uninstallable as written (uvr-r is not on CRAN — now `pak::pak("nbafrank/uvr-r")`); renv's "run scripts" cell was wrong in both feature matrices (`renv::run()` exists); the rig admin footnote now cites rig's own FAQ (no admin, period — not just Windows); the site claimed an \~8 MB binary (it is \~12 MB); the `uvr doctor` example was refreshed to current output; `uvr self-update` is documented under its canonical name `uvr upgrade`. Verified-as-written and left alone: install script behavior, AUR packages, platform table, glibc/musl build channels, activation docs, standalone-script docs, all remaining matrix cells. - **Corrected false claims in the docs, flagged by r/rstats.** The README's Rationale said renv installs are "slow and require compilation on Linux" (mirror-dependent, not true with a binary repo like P3M — our own benchmark shows it), said pak has "no lockfile" (`pak::lockfile_create()` exists, and our own feature matrix said Y), and the website's comparison table still had rv's column from before PR [#&#8203;254](https://github.com/nbafrank/uvr/issues/254) (no `rv run`, no sysdeps, no CI mode). All fixed. - **The website's benchmark numbers were invalid and are replaced.** `bench.sh` pointed every R tool at P3M's source-only path (`p3m.dev/cran/latest`), so in the Linux container install.packages and pak compiled everything from source (865s / 414s for tidyverse) while uvr used binaries — that is not a comparison, and the "142x" headline built on it was wrong. The script now uses the `__linux__/<codename>` binary path plus an R User-Agent on Linux, and the site now shows the corrected container run (cold tier: uvr 10.4s vs install.packages 29.2s for tidyverse — 2.8x, not 142x; warm runs are far faster still). The same fix made the pathological pak and warm-sync numbers from [#&#8203;235](https://github.com/nbafrank/uvr/issues/235)/[#&#8203;237](https://github.com/nbafrank/uvr/issues/237) disappear, so those were likely the mirror bug too. - **`--install-system-deps` now runs the setup commands the sysreqs rules carry**, so it works on distros where the packages do not exist until a repository is enabled. 63 of the 131 vendored rule files have a `pre_install` and 2 have a `post_install`, and uvr dropped all of them: on Rocky 9 it tried to install `gdal3.4-devel` from repos that were never enabled, and `rJava` never got its `R CMD javareconf`. `pre_install` now runs before the batched package install and `post_install` after, both only when something is actually missing, so a fully provisioned machine does not re-enable EPEL on every sync. Nothing runs without `--install-system-deps` / `UVR_INSTALL_SYSREQS=1`. - **The consent block says where each root command comes from and what it does.** These are shell strings run as root, and two of them are worth reading before approving: they arrive either from uvr's vendored `r-system-requirements` snapshot or from Posit's API fetched during that sync, and some of them fetch and execute remote code, install from a URL, disable signature checking, or add a third-party repository. Each command is now listed with both, on stderr alongside the prompt and unconditionally, so redirecting stdout to a build log cannot separate the consent from what it covers. The block also states that an unannotated command is one uvr matched no pattern in rather than one it vetted. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODguMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4OC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

automation-bot added 1 commit 2026-10-11 00:32:44 +00:00

chore(deps): update dependency nbafrank/uvr to v0.4.7 3426d5f59f

automation-bot scheduled this pull request to auto merge when all checks succeed 2026-10-11 00:32:45 +00:00

automation-bot merged commit 3426d5f59f into main 2026-10-11 00:32:46 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

devxy/build-cran-binaries!229

No description provided.