• Fixed an issue where renv::dependencies() could fail for chunks which
  had a label which was not a length-one character vector. (#2144)

• Fixed an issue where file.rename() could fail when unpacking a
  package during installation in certain Windows environments. (#2156)

• renv's dependency discovery now supports usages of base::use(). (#2130)

• Fixed an issue where renv could fail to parse remote references
  containing an @ character. (#2135)

• Fixed an issue where renv::sysreqs(distro = <...>) could fail when
  passed an alternate distribution without a version specifier. (#2105)

• Fixed an issue where multimode R documents containing chunk headers
  which did not parse to an R list could cause dependency inference
  to fail. (#2110)

• Fixed an issue where renv could erroneously record packages installed
  from Posit Package Manager snapshots as being installed from CRAN. (#2104)

• renv now only checks for archived packages during installation when
  options(renv.install.allowArchivedPackages = TRUE) is set. This fixes
  an issue where renv could erroneously discover that Rcpp 1.3 was available
  when using the Posit Package Manager repository.

• Fixed an issue where renv::dependencies() could fail with an
  unhelpful error message if the scanned document contained a
  YAML header whose contents was not a map. (#2117)

• Fixed an issue where renv::hydrate() could fail to install packages
  discovered in the user library during renv::init(). (#2109)

• renv::update() now only updates the packages installed in the project
  library by default. renv::update(all = TRUE) can be used to also
  check if packages installed in the default library are out-of-date, and
  install updated copies into the project library. (#2108)

• Fixed an issue where package installation could fail on Arch Linux with the
  error message "don't know how to check sysreqs on this system". (#2107)

• renv now supports profile-specific comments within .gitignore and
  .renvignore files. These are comments of the form #| <code>, where
  <code> is R code which should indicate if the .renvignore rules should
  apply. Typically, this should be of the form #| profile == "extra", or
  #| profile %in% c("extra", "other"). Note that only a small subset of
  base R functions are available for evaluation in this context. Note that
  the first section in a .renvignore implicitly applies to all profiles --
  if you want to limit it to just the default profile, you can use
  #| profile == "default" for the first line. (#1662)

• The environment variable RENV_PATHS_VERSION can now be used to substitute
  the R version component normally used in library / cache paths. The provided
  path can include placeholders like %V for the full R version including
  the patch level, and %v for the R version without the patch level. Defaults
  to R-%v when unset. (#1687)

• renv::install() gains the transactional argument, for parity with
  renv::restore(). (#1109)

• renv gains the sysreqs() function, which can be used to query the system
  packages required by a set of R packages. Functionality is currently available
  for Debian-based distributions, as well as Red Hat distributions.

• On Linux, renv now uses the database from
  https://github.com/rstudio/r-system-requirements when determining if
  an R package's required system libraries are installed, and notifies
  the user which packages (if any) are missing during install / restore.

• Fixed an issue where renv could fail to retrieve credentials registered
  for 'github.com' when querying URLs at 'api.github.com'.

• Fixed an issue where renv could stall when loading a project and validating
  that the configured version of Bioconductor is compatible with the version
  of R currently in use.

• renv::snapshot() no longer fails to generate a new lockfile if the project
  contains a lockfile which could not be read or parsed.

• Fixed an issue where lockfiles containing unicode characters were not
  correctly written or read with versions of R (< 4.2.0) on Windows. (#2091)

• Fixed an issue where very long lockfiles could be truncated on write. (#2089)

• Fixed an issue where renv inadvertently made web requests in
  tests during R CMD check.

Major Changes

• renv now includes additional package DESCRIPTION fields in the lockfile.
  This can be useful for validating the provenance of packages recorded in the
  lockfile, and also for applications using renv which would like to
  recompute the hash used for package caching from the lockfile itself.

  If needed, old-style lockfiles can be generated by setting the option
  options(renv.lockfile.version = 1). Note that this version of renv
  remains compatible both with the older (minimal) lockfiles, as well
  as with the newer lockfiles in this release. (#2057)

Other Fixes

• The renv sandbox is now unlocked on exit after a call to renv::use().
  This should alleviate issues seen where R's attempts to clean up the
  temporary directory could fail due to inadequate permissions on the
  sandbox directory. (#2076)

• Fixed an issue where renv::restore() did not respect the named repository
  within the lockfile when installing packages from the archives of the
  configured package repositories. (#2081)

• Fixed an issue where renv::snapshot() could fail if invoked within
  a project containing empty or invalid .ipynb files. (#2073)

• Fixed an issue where R package installation could fail if the project
  depended on a package whose current version available from the configured
  package repositories required on a newer version of R than what was currently
  installed, even if that package need not be updated. (#2071)

• Fixed an issue where RENV_CONFIG_EXTERNAL_LIBRARIES was incorrectly
  split when using Windows paths. (#2069)

• Fixed an issue where renv failed to restore packages installed from
  r-universe when the associated lockfile record had no RemoteRef field.
  (#2068)

• renv now detects dependencies from usages of utils::citation(). (#2047)

• Fixed an issue where packages installed from r-universe via an explicit
  URL remote could not be restored. (#2060)

• Fixed an issue where the repositories provided to renv::init() were ignored
  when also initializing renv with a specific version of Bioconductor.

• renv::install() gains the include parameter, which can be useful when
  you'd like to install a subset of dependencies within a project while also
  respecting any declared remotes in that project's DESCRIPTION file. (#2055)

• Fixed an issue where renv could fail to check for updates for packages
  installed using pak without an explicit branch specified. (#2040)

• renv::use() no longer re-installs packages which are already installed
  and compatible with the requested packages. (#2044)

• Fixed an issue where renv::init() could fail when using named remotes
  in a DESCRIPTION file's Remotes: field. (#2055)

• Fixed an issue where ignore rules of the form !*.* were not parsed
  and handled correctly during dependency discovery. (#2052)

• Fixed an issue where renv erroneously reported that installed packages were
  cached when the cache was not writable. (#2041).

• renv now supports updating of currently-installed packages via renv::install()
  when configured to use pak. (#2037)

• Fixed an issue where renv library paths were not properly reset following
  a suspend / resume in RStudio Server. (#2036)

• renv::run() gains the args parameter, which can be used to pass command-line
  arguments to a script. (#2015)

• renv now infers a dependency on rmarkdown and knitr for R scripts which
  include YAML front-matter. (#2023)

• The performance of renv's built-in JSON reader has been improved. (#2021)

• Fixed an issue where renv could erroneously create a binding called 'object'
  in the global environment on startup. (#2017)

• Fixed an issue where headers were not properly passed to available.packages()
  during renv bootstrap. (#1942)

• renv now assumes that Artifactory package repositories will use a CRAN-like
  layout of packages for packages in the archive. (#1996)

• renv now includes compiled extensions on Linux + macOS. These
  extensions are primarily used to improve the performance of
  renv::dependencies() and other static analysis code.
  Support for Windows may come in a future release.

• Fixed an issue where renv::snapshot() could fail if the project
  contained a call to module() with no arguments. (#2007)

• On Linux, renv now emits a message on load if the R temporary directory
  is within a folder that has been mounted as 'noexec'. This message can be
  suppressed by setting the RENV_TEMPDIR_NOEXEC_CHECK=FALSE environment
  variable.

• Fixed a performance regression in renv::dependencies(). (#1999)

• Fixed an issue where renv tests could fail if the parallel package was
  loaded during test execution.

• renv now determines a package repository's type through the HTTP headers
  provided when accessing src/contrib/PACKAGES. This is mainly relevant
  when detecting Nexus and Artifactory repositories.

• Fixed an issue where repository URLs were inappropriately transformed into
  binary repository URLs on Linux. (#1991)

• Fixed an issue where code following source("renv/activate.R") in the project
  .Rprofile was not invoked for projects using RStudio. (#1990)

• renv now infers a dependency on the ragg package when the ragg_png device
  is used in R Markdown / Quarto documents, for documents using the code
  knitr::opts_chunk$set(dev = "ragg_png"). (#1985)

• renv now automatically generates a lockfile when loading a project containing
  a manifest.json file (typical for application bundles published to Posit Connect).
  (#1980, @toph-allen)

• renv::install() now errs if an incompatible type argument is provided.

• renv::checkout() now also checks out the version of renv available
  and associated with the requested snapshot date. (#1966)

• Fixed an issue where renv::hydrate() did not hydrate packages which
  were also listed as dependencies within a project's DESCRIPTION file.
  (#1970)

• Fixed an issue where renv::checkout() omitted some fields from lockfile
  records when using actions = c("snapshot", "restore"). (#1969)

• renv gains the function renv::retrieve(), which can be used to download
  packages without installing them. This is primarily useful in CI / CD scenarios,
  where you might want to download packages in a single stage before attempting
  to install / restore them. (#1965)

• renv now preserves Remote fields present on packages installed from
  public package repositories (e.g. https://r-universe.dev/). (#1961)

• Fixed an issue where renv::load() could fail to load an alternate project
  when options(renv.config.autoloader.enabled = FALSE) was set. (#1959)

• renv now emits clickable hyperlinks for runnable code snippets and help,
  for front-ends which support the ide:run and ide:help ANSI escapes.

• renv::init(bioc = "<version>") now prompts the user in interactive sessions
  when requesting a version of Bioconductor which is not compatible with the
  current version of R. (#1943)

• renv::restore() gains the transactional argument, which can be
  used to control whether renv will allow successfully-installed
  packages remain in the project library even if a package fails
  to install during a later step. (#1109)

• renv now infers a dependency on the xml2 package for projects
  using the testthat::JunitReporter for tests. (#1936)

• Fixed an issue where renv::dependencies() could emit a warning
  when attempting to parse chunks using chunk options like
  #| eval: c(1, 2). (#1906)

• renv::install() now properly delegates the type and rebuild
  arguments to pak when options(renv.config.pak.enabled = TRUE)
  is set. (#1924)

• renv now infers a dependency on the svglite package if it detects
  calls of the form ggsave(filename = "path.svg"). (#1930)

• renv now supports setting of GitHub authentication credentials via
  any of GITHUB_TOKEN, GITHUB_PAT, and GH_TOKEN. (#1937)

• renv now also passes any custom headers available to
  utils::available.packages() during bootstrap. (#1942)

• Fixed an issue where renv could fail during installation of packages
  stored within repository sub-directories, if that repository also
  contained a top-level DESCRIPTION file. (#1941)

• renv now normalizes lockfile entries for Bioconductor packages installed
  via pak::pkg_install(), to help prevent spurious diffs being produced
  via renv::status(). (#1920)

• renv::install() now respects the prompt parameter when pak is enabled,
  as via options(renv.config.pak.enabled = TRUE). (#1907)

• Fixed an issue with renv's pak integration where renv could install the
  wrong version of a GitHub package during restore if
  options(renv.config.pak.enabled = TRUE) was set. (#1883)

• renv no longer interacts with the user during autoloading, which coincides
  with R startup. If the IDE offers a session init hook (RStudio does),
  loading is deferred until startup is complete and interaction is possible.
  Otherwise, any suggested renv actions, such as renv::restore(), are emitted
  as a message for the user to act on. (#1879, #1915).

• Fixed an issue where installation of packages from local sources, as via
  install("<package>", repos = NULL, type = "source"), could fail. (#1880)

• A new function, renv::lockfile_validate(), can be used to validate your renv.lock
  against a default or custom schema. (#1889)