• A new setting, snapshot.dev, has been added to control whether development
  dependencies are included by default when calling renv::snapshot() or
  renv::status(). This setting defaults to FALSE. (#2190)

• RENV_CONFIG_REPOS_OVERRIDE now supports multiple named repositories using
  the syntax NAME1=URL1;NAME2=URL2. Single repository URLs continue to be
  supported.

• Fixed an issue where renv::sysreqs() could fail on operating systems
  which don't declare a VERSION_ID in /etc/os-release. (#2197)

• renv::dependencies() now detects packages used in e.g.
  data(<dataset>, package = <package>). (#2181)

• Fixed an issue where cache callbacks (e.g. those run by setting
  RENV_CACHE_USER and RENV_CACHE_MODE, or via the renv.cache.callback
  option) were not run after renv::hydrate(). (#2179)

• renv::embed() now errs if one or more of the package dependencies to
  be included within a file are not available. (#2178)

• renv gains the function renv::vulns(), which can be used to query
  vulnerability information from a Posit Package Manager instance.
  This information can be queried either for a specific set of packages,
  or for all packages defined in a lockfile.

• renv now also supports RENV_LOCKFILE_VERSION = 1 as an alternate
  way to request the older, compact lockfiles. (#2175)

• The version check in renv::status() can now be disabled by setting
  options(renv.status.check_version = FALSE). (#2167)

• Fixed an issue where the package manager URL was computed incorrectly
  with RHEL 10.

• renv now prints the version numbers of the packages it downloads during
  install and restore. (#1925)

• The renv configuration option bioconductor.init can now be used to
  control the default argument passed for the bioconductor parameter in
  calls to renv::init(). (#2128)

• renv now supports bootstrapping itself from the global package
  cache. (#1799)

• renv now prefers appending, rather than prepending, Bioconductor
  repositories to the current set of repositories when installing
  packages. This implies that if you're using a repository that also
  provides Bioconductor packages, this repository will be preferred
  as opposed to the "default" Bioconductor repositories. (#2128)

• renv::restore() now ignores the Repository field on lockfile entries
  when the repos.override configuration option is set. (#2127)

• renv::restore() now transforms binary repository URLs appropriately,
  for installed packages which were recorded as installed from an
  alternate binary repository URL. (#2127)

• Fixed an issue where renv::dependencies() could fail for chunks which
  had a label which was not a length-one character vector. (#2144)

• Fixed an issue where file.rename() could fail when unpacking a
  package during installation in certain Windows environments. (#2156)

• renv's dependency discovery now supports usages of base::use(). (#2130)

• Fixed an issue where renv could fail to parse remote references
  containing an @ character. (#2135)

• Fixed an issue where renv::sysreqs(distro = <...>) could fail when
  passed an alternate distribution without a version specifier. (#2105)

• Fixed an issue where multimode R documents containing chunk headers
  which did not parse to an R list could cause dependency inference
  to fail. (#2110)

• Fixed an issue where renv could erroneously record packages installed
  from Posit Package Manager snapshots as being installed from CRAN. (#2104)

• renv now only checks for archived packages during installation when
  options(renv.install.allowArchivedPackages = TRUE) is set. This fixes
  an issue where renv could erroneously discover that Rcpp 1.3 was available
  when using the Posit Package Manager repository.

• Fixed an issue where renv::dependencies() could fail with an
  unhelpful error message if the scanned document contained a
  YAML header whose contents was not a map. (#2117)

• Fixed an issue where renv::hydrate() could fail to install packages
  discovered in the user library during renv::init(). (#2109)

• renv::update() now only updates the packages installed in the project
  library by default. renv::update(all = TRUE) can be used to also
  check if packages installed in the default library are out-of-date, and
  install updated copies into the project library. (#2108)

• Fixed an issue where package installation could fail on Arch Linux with the
  error message "don't know how to check sysreqs on this system". (#2107)

• renv now supports profile-specific comments within .gitignore and
  .renvignore files. These are comments of the form #| <code>, where
  <code> is R code which should indicate if the .renvignore rules should
  apply. Typically, this should be of the form #| profile == "extra", or
  #| profile %in% c("extra", "other"). Note that only a small subset of
  base R functions are available for evaluation in this context. Note that
  the first section in a .renvignore implicitly applies to all profiles --
  if you want to limit it to just the default profile, you can use
  #| profile == "default" for the first line. (#1662)

• The environment variable RENV_PATHS_VERSION can now be used to substitute
  the R version component normally used in library / cache paths. The provided
  path can include placeholders like %V for the full R version including
  the patch level, and %v for the R version without the patch level. Defaults
  to R-%v when unset. (#1687)

• renv::install() gains the transactional argument, for parity with
  renv::restore(). (#1109)

• renv gains the sysreqs() function, which can be used to query the system
  packages required by a set of R packages. Functionality is currently available
  for Debian-based distributions, as well as Red Hat distributions.

• On Linux, renv now uses the database from
  https://github.com/rstudio/r-system-requirements when determining if
  an R package's required system libraries are installed, and notifies
  the user which packages (if any) are missing during install / restore.

• Fixed an issue where renv could fail to retrieve credentials registered
  for 'github.com' when querying URLs at 'api.github.com'.

• Fixed an issue where renv could stall when loading a project and validating
  that the configured version of Bioconductor is compatible with the version
  of R currently in use.

• renv::snapshot() no longer fails to generate a new lockfile if the project
  contains a lockfile which could not be read or parsed.

• Fixed an issue where lockfiles containing unicode characters were not
  correctly written or read with versions of R (< 4.2.0) on Windows. (#2091)

• Fixed an issue where very long lockfiles could be truncated on write. (#2089)

• Fixed an issue where renv inadvertently made web requests in
  tests during R CMD check.

Major Changes

• renv now includes additional package DESCRIPTION fields in the lockfile.
  This can be useful for validating the provenance of packages recorded in the
  lockfile, and also for applications using renv which would like to
  recompute the hash used for package caching from the lockfile itself.

  If needed, old-style lockfiles can be generated by setting the option
  options(renv.lockfile.version = 1). Note that this version of renv
  remains compatible both with the older (minimal) lockfiles, as well
  as with the newer lockfiles in this release. (#2057)

Other Fixes

• The renv sandbox is now unlocked on exit after a call to renv::use().
  This should alleviate issues seen where R's attempts to clean up the
  temporary directory could fail due to inadequate permissions on the
  sandbox directory. (#2076)

• Fixed an issue where renv::restore() did not respect the named repository
  within the lockfile when installing packages from the archives of the
  configured package repositories. (#2081)

• Fixed an issue where renv::snapshot() could fail if invoked within
  a project containing empty or invalid .ipynb files. (#2073)

• Fixed an issue where R package installation could fail if the project
  depended on a package whose current version available from the configured
  package repositories required on a newer version of R than what was currently
  installed, even if that package need not be updated. (#2071)

• Fixed an issue where RENV_CONFIG_EXTERNAL_LIBRARIES was incorrectly
  split when using Windows paths. (#2069)

• Fixed an issue where renv failed to restore packages installed from
  r-universe when the associated lockfile record had no RemoteRef field.
  (#2068)

• renv now detects dependencies from usages of utils::citation(). (#2047)

• Fixed an issue where packages installed from r-universe via an explicit
  URL remote could not be restored. (#2060)

• Fixed an issue where the repositories provided to renv::init() were ignored
  when also initializing renv with a specific version of Bioconductor.

• renv::install() gains the include parameter, which can be useful when
  you'd like to install a subset of dependencies within a project while also
  respecting any declared remotes in that project's DESCRIPTION file. (#2055)

• Fixed an issue where renv could fail to check for updates for packages
  installed using pak without an explicit branch specified. (#2040)

• renv::use() no longer re-installs packages which are already installed
  and compatible with the requested packages. (#2044)

• Fixed an issue where renv::init() could fail when using named remotes
  in a DESCRIPTION file's Remotes: field. (#2055)

• Fixed an issue where ignore rules of the form !*.* were not parsed
  and handled correctly during dependency discovery. (#2052)

• Fixed an issue where renv erroneously reported that installed packages were
  cached when the cache was not writable. (#2041).

• renv now supports updating of currently-installed packages via renv::install()
  when configured to use pak. (#2037)

• Fixed an issue where renv library paths were not properly reset following
  a suspend / resume in RStudio Server. (#2036)

• renv::run() gains the args parameter, which can be used to pass command-line
  arguments to a script. (#2015)

• renv now infers a dependency on rmarkdown and knitr for R scripts which
  include YAML front-matter. (#2023)

• The performance of renv's built-in JSON reader has been improved. (#2021)

• Fixed an issue where renv could erroneously create a binding called 'object'
  in the global environment on startup. (#2017)

• Fixed an issue where headers were not properly passed to available.packages()
  during renv bootstrap. (#1942)

• renv now assumes that Artifactory package repositories will use a CRAN-like
  layout of packages for packages in the archive. (#1996)

• renv now includes compiled extensions on Linux + macOS. These
  extensions are primarily used to improve the performance of
  renv::dependencies() and other static analysis code.
  Support for Windows may come in a future release.

• Fixed an issue where renv::snapshot() could fail if the project
  contained a call to module() with no arguments. (#2007)

• On Linux, renv now emits a message on load if the R temporary directory
  is within a folder that has been mounted as 'noexec'. This message can be
  suppressed by setting the RENV_TEMPDIR_NOEXEC_CHECK=FALSE environment
  variable.

• Fixed a performance regression in renv::dependencies(). (#1999)

• Fixed an issue where renv tests could fail if the parallel package was
  loaded during test execution.

• renv now determines a package repository's type through the HTTP headers
  provided when accessing src/contrib/PACKAGES. This is mainly relevant
  when detecting Nexus and Artifactory repositories.

• Fixed an issue where repository URLs were inappropriately transformed into
  binary repository URLs on Linux. (#1991)

• Fixed an issue where code following source("renv/activate.R") in the project
  .Rprofile was not invoked for projects using RStudio. (#1990)