[pull] master from JuliaLang:master#4
Open
pull[bot] wants to merge 323 commits into
Open
Conversation
… subdir is devved by name (#4271)
Co-authored-by: KristofferC <kristoffer.carlsson@juliacomputing.com>
…4277) Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: KristofferC <kristoffer.carlsson@juliacomputing.com>
Co-authored-by: KristofferC <kristoffer.carlsson@juliacomputing.com> Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: KristofferC <kristoffer.carlsson@juliacomputing.com>
Co-authored-by: KristofferC <kristoffer.carlsson@juliacomputing.com> Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Morten Piibeleht <morten.piibeleht@gmail.com> Co-authored-by: Kristoffer Carlsson <kcarlsson89@gmail.com>
Co-authored-by: Kristoffer Carlsson <kcarlsson89@gmail.com>
Co-authored-by: Kristoffer Carlsson <kcarlsson89@gmail.com>
Co-authored-by: Ian Butterworth <i.r.butterworth@gmail.com>
Co-authored-by: Ian Butterworth <i.r.butterworth@gmail.com>
…ackages in manifest, re-resolving" message (#3525) Co-authored-by: Ian Butterworth <i.r.butterworth@gmail.com>
Co-authored-by: Ian Butterworth <i.r.butterworth@gmail.com>
Co-authored-by: Ian Butterworth <i.r.butterworth@gmail.com>
Co-authored-by: Ian Butterworth <i.r.butterworth@gmail.com>
Co-authored-by: KristofferC <kristoffer.carlsson@juliacomputing.com> Co-authored-by: Ian Butterworth <i.r.butterworth@gmail.com>
Co-authored-by: Ian Butterworth <i.r.butterworth@gmail.com>
…rethrow the caught exception unless it is a `ProcessFailedException` (#2976)
* activate: warn if different versions are loaded * Add tests, docs, and changelog for activate mismatch warning - CHANGELOG: note the new warning under v1.14. - environments.md: document that activation does not unload modules and Pkg now warns on path/version mismatches. - test/api.jl: subprocess tests covering the warning, suppression on re-activating the same env, and the per-(project, package) dedup.
Bumps [julia-actions/setup-julia](https://github.com/julia-actions/setup-julia) from 2 to 3. - [Release notes](https://github.com/julia-actions/setup-julia/releases) - [Commits](julia-actions/setup-julia@v2...v3) --- updated-dependencies: - dependency-name: julia-actions/setup-julia dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ian Butterworth <i.r.butterworth@gmail.com>
…on a stale manifest (#4678) * instantiate: add `update_on_mismatch` kwarg to fall back to `update` on a stale manifest For tooling and helper environments (formatters, doc-render scripts, etc.), the strict default of `Pkg.instantiate` is the wrong fit: the maintainer wants the env to keep working across teammates editing `Project.toml` and Julia minor bumps, without paying the registry-update + precompilation cost of a blanket `Pkg.update()` on every run. The new `update_on_mismatch::Bool` kwarg (and `-u` / `--update_on_mismatch` REPL flag) makes `instantiate` fall back to `Pkg.update()` whenever the existing manifest cannot be used as-is, instead of warning or erroring. The default (`false`) preserves the existing behavior. * fix workspace forwarding --------- Co-authored-by: Ian Butterworth <i.r.butterworth@gmail.com>
* prefer adding already loaded dep versions * fix: make it a preference, not a fix * fix: prefer loaded versions via resolver weight, not pinning Remove apply_preferred_versions_to_direct! which was setting pkg.version = VersionSpec(pref_version) for direct deps, creating a hard constraint instead of a soft preference. The resolver's PREFERRED_VERSION_WEIGHT_BONUS already handles this correctly as a soft preference for all packages (both direct and indirect). Also pass preferred_versions to all resolution tiers instead of only an extra first tier. Since the weight bonus is additive and cannot cause resolver errors, it can safely apply at every tier. Co-authored-by: Claude <noreply@anthropic.com>" * Fix preferred version bonus lost when eq class representative is higher version When build_eq_classes1! merges versions with identical compatibility into equivalence classes, it previously always chose the highest version as the representative. If the preferred (already-loaded) version was not the highest, it would be collapsed away and the PREFERRED_VERSION_WEIGHT_BONUS could never be applied, causing the resolver to pick the newer version instead. Fix by detecting when a preferred version falls inside an equivalence class and promoting it to be the representative of that class. Co-authored-by: Claude <claude@anthropic.com> * Refactor: scope preferred-loaded variables inside if target == :deps * Default prefer_loaded_versions to REPL mode only Pkg.add (functional API) now defaults to prefer_loaded_versions=false for reproducibility, while pkg> add (REPL mode) defaults to true so interactive use stays loading-consistent. Co-authored-by: Claude <noreply@anthropic.com> * Mention pkg> up in prefer_loaded_versions docs Co-authored-by: Claude <noreply@anthropic.com> * Code review fixes for prefer_loaded_versions - Fix Pkg.add docstring example to demonstrate opting in (=true) rather than the now-default-in-functional-mode =false. - Flip Operations.add internal default to false to match the "programmatic call = pure" stance; API.add always passes the kwarg. - Add a REPL-mode test using IN_REPL_MODE scoped value to lock in that the REPL default is on without an explicit kwarg. Co-authored-by: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <claude@anthropic.com> Co-authored-by: Claude <noreply@anthropic.com>
…4682) * Add precompile statements for `Val{PkgArtifacts}` artifact dispatch. Avoids load-time codegen in JLL packages using `using Pkg.Artifacts`. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * precompile: resolve stdlib `Artifacts` via `parentmodule` and guard internals `PkgArtifacts.Artifacts._artifact_str` resolved to `PkgArtifacts._artifact_str` (since `const Artifacts = PkgArtifacts` shadows the stdlib name and `Pkg` then re-aliases the same way), which is undefined. Use `parentmodule` on an imported stdlib function to reach the real `Artifacts` module, and gate each precompile on `isdefined` so it stays robust if the internals change in future Julia versions. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Pins the default GITHUB_TOKEN to contents: read on workflows that don't call a GitHub API beyond the initial checkout. Other workflows that need write scopes are left implicit for a maintainer to declare. Motivation: CVE-2025-30066 (March 2025 tj-actions/changed-files compromise) exfiltrated GITHUB_TOKEN from workflow logs. Per-workflow caps bound runtime authority irrespective of repo or org default, give drift protection, and are credited per-file by the OpenSSF Scorecard Token-Permissions check. YAML validated locally with yaml.safe_load. Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
This removes a bunch of invalidations when loading JSON.jl on 1.13.
Co-authored-by: Kristoffer Carlsson <kcarlsson89@gmail.com>
* Iterate over `values(reg.pkgs)` in `available_names()` This removes a bunch of invalidations when loading JSON.jl on 1.13. * Avoid recursive getproperty() calls in _ensure_registry_loaded_slow! Co-authored-by: Kristoffer Carlsson <kcarlsson89@gmail.com> --------- Co-authored-by: Kristoffer Carlsson <kcarlsson89@gmail.com>
Use ArgTools.FileSpec for the package-server auth refresh download so the temporary token response is created with mode 0o600 before parsing it. This avoids exposing the refreshed access token through default temporary-file permissions while preserving ordinary AbstractString download behavior elsewhere. The refresh response carries a short-lived package-server access token used as the bearer credential for authenticated package-server requests. The refresh token remains in the existing auth.toml and is sent only as the Authorization header to the refresh URL. Addresses JLSEC-2026-610. Co-authored-by: Keno Fischer <Keno@users.noreply.github.com> Co-authored-by: Codex <codex@openai.com>
…on → cxxlib_version) (#4708) JuliaLang/julia#59029 ("binaryplatforms: Add abi tags for ucrt/cxxlib") changed `Base.BinaryPlatforms` so that constructing a `Platform` with a `libstdcxx_version` tag now translates it into `cxxlib=libstdcxx` plus a `cxxlib_version` tag; the literal `libstdcxx_version` key is no longer stored. The artifacts test set the compare strategy directly on `libstdcxx_version`, which now throws `ArgumentError: Cannot set comparison strategy for nonexistent tag libstdcxx_version!` on nightly, erroring the Pkg test suite. Set the compare strategy on whichever version tag the platform actually ended up with, so the test passes on both older Julia (which keeps `libstdcxx_version`) and newer Julia (which uses `cxxlib_version`). Co-authored-by: Keno Fischer <Keno@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The submodule name validation only accepted a single identifier, rejecting e.g. `submodule = "CLI.Nested"` even though `julia -m` supports dotted module paths. Fixes #4551 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
When the package Project.toml is copied into the app environment, relative [sources] paths kept pointing relative to the copy instead of the original package. Resolve them against the original location (for local path adds) or the installed package tree, and drop entries that cannot be resolved so the dependency is resolved from a registry instead. Also respect a pre-existing entryfile in the project instead of assuming src/<name>.jl. Fixes #4532, fixes #4714 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Shims from Apps.develop point the load path directly at the dev'd project, which may not have a resolved manifest, making the app fail with "package is required but does not seem to be installed". Instantiate the project when developing it. Fixes #4697 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Apps.update had an inverted condition making no-arg update a no-op, and for a specific package it only ran Pkg.update() inside the app environment, which can never bump the app itself since the app is the project of that environment. It also rewrote the AppManifest entry with data from the app environment manifest, corrupting the path field and causing errors on subsequent updates. Update now re-adds registry and repo tracked apps (resolving the latest version/revision) and for developed apps updates the developed project and regenerates the shims. Updating by app name and erroring on unknown names now also work. Fixes #4634 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Removing apps by name mutated the manifest dict while iterating it, removed the app environment directory without force (erroring for developed packages where it does not exist), and silently succeeded when nothing matched. Also deduplicate the AppManifest path and a double registry lookup. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Add docstrings for Pkg.Apps.add/develop/update/status/rm and reference them from the apps documentation. Also document how to install apps from URLs and local paths and note that the two TOML forms of [apps] entries are equivalent. Fixes #4525, fixes #4591 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Remove shims for apps that a new version of a package no longer provides (previously orphaned forever) and warn when an app name collides with one provided by another package. - Error on `app add`/`app develop` with no arguments instead of silently doing nothing. - Skip registry versions whose julia compat excludes the running julia when resolving the version to install. - precompile() activated a non-existent app environment for developed packages; use the developed project instead. - Use julia.exe consistently on Windows for the shim julia path, matching the julia_command recorded in the AppManifest. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…error types - Serialize mutating app operations (add/develop/update/rm) across processes with a pidfile lock on the apps environment folder, reentrant within a process since update calls add/develop. - Rebuild "$@" in place in the shell shim instead of joining julia args into a whitespace-split string: argument boundaries, empty arguments and glob characters now survive exactly. - Make installations relocatable: shims locate the depot from their own location (falling back to the install time depot, e.g. for symlinked shims), JULIA_DEPOT_PATH gets the default system depots appended instead of baking the install time stack, and entryfile/[sources] paths inside the depot are written relative to the app environment. Bumps shim version to 1.2. - status: send output to Pkg's io (DEFAULT_IO aware) via an io kwarg. - Throw PkgError instead of ErrorException throughout. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The new section in apps.md broke [API Reference](@ref) cross-references by making the header slug ambiguous with api.md. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Apps: allow nested submodules in app definitions The submodule name validation only accepted a single identifier, rejecting e.g. `submodule = "CLI.Nested"` even though `julia -m` supports dotted module paths. Fixes #4551 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Apps: handle relative [sources] paths and custom entryfile on app add When the package Project.toml is copied into the app environment, relative [sources] paths kept pointing relative to the copy instead of the original package. Resolve them against the original location (for local path adds) or the installed package tree, and drop entries that cannot be resolved so the dependency is resolved from a registry instead. Also respect a pre-existing entryfile in the project instead of assuming src/<name>.jl. Fixes #4532, fixes #4714 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Apps: instantiate the developed project so app dependencies load Shims from Apps.develop point the load path directly at the dev'd project, which may not have a resolved manifest, making the app fail with "package is required but does not seem to be installed". Instantiate the project when developing it. Fixes #4697 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Apps: make update actually update apps Apps.update had an inverted condition making no-arg update a no-op, and for a specific package it only ran Pkg.update() inside the app environment, which can never bump the app itself since the app is the project of that environment. It also rewrote the AppManifest entry with data from the app environment manifest, corrupting the path field and causing errors on subsequent updates. Update now re-adds registry and repo tracked apps (resolving the latest version/revision) and for developed apps updates the developed project and regenerates the shims. Updating by app name and erroring on unknown names now also work. Fixes #4634 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Apps: fix rm of individual apps Removing apps by name mutated the manifest dict while iterating it, removed the app environment directory without force (erroring for developed packages where it does not exist), and silently succeeded when nothing matched. Also deduplicate the AppManifest path and a double registry lookup. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Apps: document the Apps API Add docstrings for Pkg.Apps.add/develop/update/status/rm and reference them from the apps documentation. Also document how to install apps from URLs and local paths and note that the two TOML forms of [apps] entries are equivalent. Fixes #4525, fixes #4591 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Apps: test that update of a repo-tracked app fetches new commits Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Apps: second pass of fixes - Remove shims for apps that a new version of a package no longer provides (previously orphaned forever) and warn when an app name collides with one provided by another package. - Error on `app add`/`app develop` with no arguments instead of silently doing nothing. - Skip registry versions whose julia compat excludes the running julia when resolving the version to install. - precompile() activated a non-existent app environment for developed packages; use the developed project instead. - Use julia.exe consistently on Windows for the shim julia path, matching the julia_command recorded in the AppManifest. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Apps: locking, robust shim arguments, relocatable depots, status io, error types - Serialize mutating app operations (add/develop/update/rm) across processes with a pidfile lock on the apps environment folder, reentrant within a process since update calls add/develop. - Rebuild "$@" in place in the shell shim instead of joining julia args into a whitespace-split string: argument boundaries, empty arguments and glob characters now survive exactly. - Make installations relocatable: shims locate the depot from their own location (falling back to the install time depot, e.g. for symlinked shims), JULIA_DEPOT_PATH gets the default system depots appended instead of baking the install time stack, and entryfile/[sources] paths inside the depot are written relative to the app environment. Bumps shim version to 1.2. - status: send output to Pkg's io (DEFAULT_IO aware) via an io kwarg. - Throw PkgError instead of ErrorException throughout. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Apps: rename docs section to avoid duplicate API Reference slug The new section in apps.md broke [API Reference](@ref) cross-references by making the header slug ambiguous with api.md. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.1)
Can you help keep this open source service alive? 💖 Please sponsor : )