Posit Package Manager Release Notes

Published

September 9, 2026

Please submit the Posit support form with questions about the described changes.

2026.09.0

September 09, 2026

Breaking

#19113 Disabling an experimental feature no longer hides the repositories and sources created while it was enabled: Package Manager still lists them, serves them, and keeps them in sync. Delete them to stop Package Manager from serving them. See Experimental Features.
#19974 Go 1.27 changed gzip output, so the SHA-256 checksum of rewritten tarballs differs from earlier releases. Stored source packages are not affected. An rspm add --overwrite re-upload of the same file creates one new record. Subsequent uploads deduplicate again. Binary packages keep their published Sha256Hash. Nothing recomputes on upgrade.
#19508 Managing Git credentials now requires the new credentials:admin scope, which delegates credential administration without global:admin. Create a separate credentials:admin token for automation that used a sources:write token to create credentials.
#19509 Attaching a Git credential to a Git builder now also requires credentials:admin, alongside sources:write on the source. Repeat --scope to grant both to one token. Every SSH builder uses a credential, so this affects all of them. A startup log lists existing credential-backed builders.
#19836 Version constraints that write two comparisons without a comma, such as >=1.0<2.0, are now rejected for Python and R. Write them as >=1.0,<2.0. Package Manager previously inserted a comma the input never contained, matching versions never requested.
#19531 Locally uploaded VS Code extensions are now verified only when their source declares the publisher namespace with --publisher-namespaces on rspm create source or rspm edit source. Extensions on existing sources are unverified until you declare one. Mirrored Open VSX extensions are unaffected.
#19531 Package Manager now rejects an uploaded .vsix whose publisher or name contains a control or invisible character, or whitespace other than surrounding spaces. An upload that previously succeeded now fails; re-package the extension with a plain publisher and name.
#19138 Python packages that declare a license only in the legacy free-form License field now report a real SPDX license type instead of Unknown. A --license-types=Unknown rule no longer matches them, so review your license blocklist rules after upgrading.
#16917 migrate database no longer migrates from PostgreSQL to SQLite; --to=sqlite3 is now rejected. Migrating from SQLite to PostgreSQL, the default direction, is unaffected. See Changing Database Provider.

New

AI & Agent Plugins

#19113 AI agent plugin hosting is now generally available. Create plugin repositories and sources without enabling an experimental feature first. Requires an Enhanced or Advanced license. See AI Agent Plugins.
#19114 Added Posit Assistant to the AI agent plugin install instructions on plugin detail pages and the repository Setup page, as the default agent. Authenticated repositories show its token settings. Requires Posit Assistant 1.3.0 or later. See Installing AI agent plugins.
#19631 The home page statistics now include a count of the AI agent plugins the server offers, alongside the existing CRAN, PyPI, and Open VSX counts.

Python & PyPI

#17806 The PyPI simple index now supports the JSON API defined by PEP 691. If a caching proxy sits in front of Package Manager, add the Accept header to its cache key. See Running with a Proxy.
#17806 The PyPI JSON simple index now publishes each file’s size and upload time and the project’s full version list, as PEP 700 specifies. uv --exclude-newer, pip install --uploaded-prior-to (pip 26.0 or later), and solver.min-release-age in Poetry (2.4.0 or later) read it.
#17806 The PyPI simple index now declares which version of the Python simple repository API its pages implement, using the pypi:repository-version metadata defined by PEP 629.

Server & Storage

#19375 Server.MemoryCacheSize now budgets the R listing, sysreqs, PyPI snapshot, and transaction-set caches alongside the package index cache. Those four held fixed ceilings totaling 448 MiB that no setting could reach, so the default rises from 100MB to 640MB to cover them rather than to grant more memory. Package Manager raises a lower configured value to the default and logs a warning. Set it to 0 to disable in-memory caching. The binary index and the two plugin caches keep their own settings.
#17623 /__cluster-health__ now returns HTTP 503 while a node is shutting down or offline, so a load balancer can drain it before it stops listening. See Health-Check.
#17623 Added a ppm_cluster_leader_requests_total metric, so monitoring can alert when a node in a Postgres cluster cannot elect a leader.
#17840 Added Posit Chronicle integration for runtime metrics collection and observability.
#19510 Added [Git] AllowedHost configuration to restrict Git Builder clone URLs to a server-wide allowlist of permitted hosts. When unset, PPM permits any host.

VS Code & Open VSX

#19532 VSX gallery API responses now include a sourceProvenance field, valued local for uploaded extensions, mirror for extensions mirrored from Open VSX, and curated for curated sources.

Bioconductor

#19692 Bioconductor repositories now accept the /bin/linux/<distro>-<arch>/<r-version> URL format that CRAN repositories have accepted since 2025.09.0. Point BioC_mirror at such a URL to serve Linux binaries without configuring a User-Agent in R.
#17794 The Bioconductor version selector now labels the release and devel versions, and defaults to the release version rather than the newest.

Air-Gapped & Offline

#20184 Added ZIP and tar.gz downloads of the Windows and macOS rspm CLI and offline downloader, for networks that block .exe files. Archives are also published for releases back to 2026.04.0. See Install the Offline Downloader.
#19810 The licensing guide now covers transferring a license file to a server in a private subnet. See License File.

Fixed

AI & Agent Plugins

#19666 #20228 Fixed a bug that allowed using some AI agent plugin endpoints without the required Enhanced or Advanced license.
#19107 A git agent plugin build no longer writes unbounded data to disk while dereferencing symlinks from a mirrored repository. AI.PluginMaxBundleSizeUncompressed now caps this work.
#20265 When Package Manager cannot read one plugin’s files, an AI agent plugin marketplace now omits that plugin, logs a warning, and serves the rest, rather than failing every client request.
#19668 Fixed an issue where serving an AI agent plugin repository used memory and time that grew sharply with its file count. A 256-file marketplace now allocates 28 MB rather than 2.4 GB.
#19985 AI agent plugin sources no longer reject a plugin whose plugin.json declares a component as a list of paths or an inline object. Mirrored git repositories also no longer fail over an unrelated broken symlink or another agent’s plugin.json.
#19668 The GET /sources/{source}/plugins endpoint now applies the _page, _limit, and name_like parameters it previously accepted and ignored, and returns the match count in X-Total-Count. rspm list packages --search, --page, and --count now filter and page as documented.
#19113 Anonymous git clone requests to plugin marketplace URLs on a server that hosts no plugin repositories now return “not found” instead of prompting for credentials.
#19667 Fixed rspm list packages --repo=<repo> for AI agent plugin repositories.
#20179 AI agent plugin detail pages now list commands/ files under Skills rather than in a separate Commands section, because Claude Code merged custom slash commands into skills.
#20268 Removed the retired Positron plugin settings from the repository Setup page and the user guide.

Python & PyPI

#20031 Package eviction no longer deletes Python distributions when their snapshot index is missing or incomplete in the packages storage class, such as after a partial restore.
#19461 Fixed the filter/packages API reporting local and Git Python packages as not blocked by a --license-types=Unknown rule. Installation was never affected. The one-time license capture runs again on the first startup after upgrading. Migration.SkipPythonLicenseCapture postpones it, and until it runs those packages show no license. Their release dates are unaffected.
#19397 Fixed license blocklist rules matching only a PyPI mirror package’s latest version, so a rule blocking it still served older releases. Each version now matches its own license.
#20134 Fixed the license and dependencies reported for a local or Git Python package version, which could come from a Windows installer or egg rather than the wheel.
#20093 Fixed the license and dependencies reported for a Python package version, which could come from its source distribution rather than its wheel. Licenses already recorded for local and Git Python packages are corrected on upgrade.
#19458 Fixed spurious context deadline exceeded and cancellation errors on PyPI package detail and pip requests served from local and Git Python sources. A request that timed out or disconnected no longer fails the other requests waiting alongside it.
#19836 Fixed Python version constraints ending in .*, and ~=, not matching versions with fewer release segments. ==2.0.* now matches 2 and !=7.0.* excludes 7.
#19836 Fixed a local Python source whose current release carries a local version label, such as 1.0+ubuntu_2, failing with no distributions for current version.
#19836 Fixed Python version constraints with uppercase pre-release, post-release, or development suffixes failing to parse. ==2.0.DEV16 and >=1.0.8A now match.
#19836 Fixed Python local version labels not being normalized, so 1.0+ubuntu-10 now sorts above 1.0+ubuntu-2 and 1.0+007 is reported as 1.0+7.
#19836 Fixed reading a Python source distribution that contains more than one PKG-INFO file, which was reported as not a valid Python package.
#20071 Reduced memory use for curated Python repositories by keeping the per-version license map out of the package cache.

Server & Storage

#17623 Fixed an issue where an ungraceful restart could stop leader election and all background jobs on Postgres clusters until an administrator cleared the queue.
#17623 Fixed queue operations reporting success when their transaction failed to commit, and failing outright on a database deadlock instead of retrying.
#20160 Package Manager now applies environment variables such as PACKAGEMANAGER_OPENIDCONNECT_ISSUER, which it previously ignored, and no longer stops at startup on others such as PACKAGEMANAGER_GROUPTOSCOPEMAPPING_<group>_SCOPE.
#15151 Fixed an issue where the file server sent compressed error, empty, and byte-range responses while the headers described them as uncompressed, so a missing file displayed binary garbage instead of 404 page not found. Those responses are now sent uncompressed.
#17623 Fixed Postgres cluster nodes in timezones with a sub-hour UTC offset, such as India and Nepal, disagreeing about the current leader election slot.
#20072 Package Manager now scans for legacy Git Builder artifacts on every start, so a migrated server no longer serves stale builder output.
#20085 Git Builder now retries a transient network failure when listing a remote’s refs and tags, instead of failing the build.
#18909 Fixed a bodyless HTTP 500 when downloading a package missing from local storage. Package Manager now reports the missing file.

R & CRAN

#19694 #19711 #19719 Fixed binary repository requests that returned a source package, an x86_64 package, an empty index, or HTTP 500 when the distribution, architecture, platform, or R version was unsupported, disabled in configuration, or malformed. They now return HTTP 404. Use /bin/windows/contrib/<r-version>/PACKAGES for Windows indexes.
#19711 Fixed an issue where /bin/linux repository URLs served source packages when the R version included a patch component such as 4.5.0.
#19998 Fixed an issue where a repository could keep serving the previous package set after a curated CRAN source was updated, until the source was updated again.
#20238 The server log no longer warns that a package will be served from source when a base R package such as grDevices appears in LinkingTo.
#19629 Fixed the Linux binary repository URL shown on the Setup page for authenticated R repositories when Other is selected. It now includes the architecture and R version. Copy the corrected snippet if you saved the instructions.
#19745 Fixed Linux binary repository URLs on the R Setup page for versions such as R 4.10. If you saved the Other instructions, copy the corrected snippet.
#19313 Fixed RPostgreSQL binary builds, which could not resolve libpq. Package Manager now supplies it through a system-requirements augmentation.

Authentication & SSO

#19870 Git Builder build artifacts no longer retain encrypted credential material, and are now removed once consumed. Upgrading removes artifacts written by earlier releases.
#19351 Fixed token exchange authorizing a request that carries actor_token as the wrong identity, ignoring subject_token. Requests carrying actor_token or actor_token_type now return HTTP 400 with an invalid_request error. Requests that send only subject_token and subject_token_type are unaffected.
#19508 Fixed an issue where editing a Git credential through the API cleared any secret the request omitted, silently emptying an HTTPS credential’s stored username and password.
#20030 rspm encrypt rotate now re-encrypts OpenIDConnect.ClientSecret and Postgres.AzureClientSecret. Previously they kept the old key, breaking sign-in or database authentication after a rotation.
#20144 rspm encrypt rotate now reports a re-encrypted value to write into the file named by OpenIDConnect.ClientSecretFile. Previously the file kept the retired key, breaking sign-in. See Values Stored in a File.
#19925 The token administration UI supports multi-scope tokens.

VS Code & Open VSX

#19541 Fixed an issue where a crafted targetPlatform query parameter on an Open VSX asset request could write files outside the cache directory.
#19531 Fixed blocklist rules not matching a VS Code extension whose stored publisher or name held an invisible character. Upgrading repairs these values unless the repair collides with another extension in the same source.
#19803 Fixed filter/packages reporting Open VSX extensions as not blocked by --license-types rules, though downloads enforced those rules.
#19665 Fixed vulnerability and Open VSX sync, which sent an encrypted Manifest.Password without decrypting it and failed against an authenticated proxy such as Artifactory.
#20121 Fixed an issue where a VS Code extension did not install on a platform that only an older version builds for. The extension gallery now reports the latest version of each target platform, and skips versions the blocklist forbids.
#19095 Fixed VS Code extension gallery asset URLs pinned to /latest/ when a client queried a dated snapshot. They now carry the requested date, so a version later removed from the latest snapshot still installs from the pinned one.
#19854 Fixed an issue where VS Code extension gallery asset URLs dropped the reverse-proxy path prefix when serving Package Manager from a sub-path.

Bioconductor

#19812 Fixed the Repository URL on the Setup page for a Bioconductor repository, which did not change when you selected a Linux distribution and so served source packages.
#19661 Fixed homepage type-ahead suggestions, which reported no matches for every search in a Bioconductor repository.

API

#19905 Fixed an issue where /repos/{repo}/vulns could hang for a repository with both CRAN and Bioconductor sources, blocking every other vulnerability request until Package Manager restarted.
#20032 Package Manager now reports a git package build log that is missing from storage, instead of serving a fabricated log and writing it back to storage.
#19695 Experimental API endpoints now return HTTP 404 until their feature is enabled.
#19637 The binary build log API now renders an interleaved build log under a single heading.

Web Interface

#19554 Fixed an issue where the Sign In modal kept the error banner and the previously pasted token after the user closed and reopened it.
#19725 The package details page now loads faster for packages with many versions, such as PyPI projects with thousands of releases.
#19582 Fixed an architecture-independent binary appearing twice, with no badges, in the Package Files card on the package details page.
#20056 Fixed an issue where a binary row on the package details page’s Binary File section could show no architecture, distribution, or R version badges.
#19686 What’s New releases are now collapsed by default, so the page opens as a skimmable list.
#20310 Fixed an issue where the What’s New banner indicator overlapped adjacent navigation elements.
#19675 The What’s New page now shows the released version instead of “Unreleased”.

Air-Gapped & Offline

#18824 Fixed a delay before the Package Manager web application appeared in air-gapped and firewalled deployments. The application no longer requests the Material Symbols icon font from fonts.googleapis.com. That font already shipped with the server.
#20036 Fixed an issue where the offline downloader’s get pypi --file-in ignored version constraints and downloaded every release of packages whose PyPI name is not lowercase and hyphenated, such as Flask.
#19426 The air-gapped guide now states that a download made with --starting-snapshot or --skip-source is not a repository on its own. Verify it after copying it into the offline data directory. See Air-Gapped Package Manager.
#19257 The Offline Downloader now verifies and retries its PyPI checkpoint download, so a truncated download no longer yields an incomplete repository.

CLI & Diagnostics

#19443 Fixed an issue where the TEXT log format replaced every = in a logged value with a space, recording ==1.1.5 as 1.1.5. Distinct DEBUG and TRACE messages logged from the same line are also no longer dropped as repeats.
#19109 Git Builder build logs now have terminal escape sequences and control characters removed, both in rspm logs and in the API, so colorized build output appears as plain text.
#19780 The product check now reports the host’s real Linux distribution instead of a generic value.

Database Migration

#16917 migrate database now checks that the destination is empty before writing to it, so pointing it at a database that already holds data no longer deletes rows before cancelling.
#19965 migrate database now resets only Package Manager’s sequences. In a database shared with another application it reset that application’s sequences, then failed with SQLSTATE 42703. See Changing Database Provider.
#16917 migrate database now fails on a read error instead of reporting a successful migration, and no longer proceeds when it cannot determine whether the destination database is empty.
#16917 migrate database --drop-all now asks for confirmation, naming the destination database, when run interactively. Scripted runs proceed without asking. See Changing Database Provider.
#20035 migrate database, including --verify, now warns before it upgrades a source database in place, which an earlier Package Manager release cannot then start against.
#16917 migrate database now treats any nonzero SQLite boolean as true. Nonzero values other than 1 migrated as false, failing verification after the copy finished.
#16917 migrate database now reports which stage failed, so a verification failure after a completed copy no longer tells administrators to discard the target database.
#16917 migrate database now writes rows in batches and rebuilds secondary indexes after loading rather than maintaining them row by row, so migrating a large database to PostgreSQL is substantially faster.
#16917 migrate database verification now compares tables as it reads them instead of loading both copies into memory, so verifying a large database no longer risks running out of memory after the data has migrated. It prints the first differences in each table and a count of the rest.
#16917 migrate database verification no longer reports a data mismatch for boolean columns holding text such as t or yes, which migrated correctly.
#16917 Fixed migrate database verification failing with invalid UUID length on a column named like a guid that does not hold a UUID.
#16917 migrate database verification no longer reports a false data mismatch for a value shorter than a fixed-width CHAR column, which PostgreSQL blank-pads.
#16917 A failed migrate database now reports the same table on every run against the same database, rather than a different one each time.
#20035 migrate database --verify now reports a successful verification rather than a successful data migration, so a log shows whether data was copied.

Documentation

#20342 Fixed release notes links, which landed on the wrong release or at the top of the page. Every release and section heading now carries a link anchor named for its release, such as #posit-package-manager-2026.08.0-fixed. The Offline Downloader release notes now use the same page design, with color-coded section badges and issue chips.
#19511 The Server API reference now documents the git-credentials endpoints for creating, listing, updating, and deleting Git credentials.

2026.08.0

August 10, 2026

Breaking

#19538 Identity federation now matches a provider’s Audience and Subject against the entire claim, rather than anywhere within it. A provider pinned to Subject = "repo:my-org/my-repo:ref:refs/heads/main" previously also accepted a branch named main-patch. Both settings are still regular expressions, so add .* wherever the claim can carry additional text. Package Manager logs a warning at startup naming each provider whose match narrowed. See Identity Federation.
#19420 License blocklist rules can now evaluate differently for roughly 5,000 of about 933,000 PyPI packages. Specific-license rules may block previously served packages; --license-types=Unknown no longer matches them. If you rely on an unknown license rule to restrict what a repository serves, review your repositories after upgrading, because it removes a restriction without an error.

New

Web Interface

#18718 Added a Settings > Overview page where administrators can review system and license details, check feature status, filter features, and open related documentation.

See Overview page for details.
#18898 #18903 #18905 The What’s-New page and online Release Notes now share a release timeline from NEWS.md, with issue chips and ordered color-coded New, Fixed, and Breaking badges.

Packages & Repository

#17789 Added precompiled binaries for the Bioconductor software packages repository on Windows, macOS, and Linux. No rebuild is required, because the binaries are already published. A package that links against a CRAN package, such as Rcpp, needs a CRAN repository on the same server. Packages without a binary for a distribution and R version, and packages missing that CRAN repository, are served from source. See Binaries for Bioconductor Sources and Cross-Ecosystem Binary Dependencies.
#18373 Added Bioconductor binary mirroring for the main Bioconductor software repository with get bioconductor --include-binaries. R versions are selected automatically; use --r-versions to narrow the download. Mirror Bioconductor and CRAN binaries into the same destination directory, because Package Manager serves both from one location. See Air-Gapped Installations.
#17061 Portable Linux binary packages are now generally available. The manylinux glibc 2.28+ distribution is no longer labeled as a preview on the Setup page. See Portable Linux Binary Packages.
#15169 Portable Linux binaries now include a CycloneDX software bill of materials (SBOM) of the system libraries they bundle, and summarize them in the Built/SystemLibs field in DESCRIPTION. Earlier binaries lack this metadata. See What is bundled in these packages?.
#18526 The offline downloader’s get cran and get bioconductor commands now accept a --file-in requirements file and download the listed packages together with all of their dependencies. (For PyPI, --file-in remains a literal package list, without automatic dependency resolution.)
#19421 Added --since=YYYY-MM-DD to limit how much package version history the Offline Downloader mirrors, for a full mirror or with --file-in. Pass the same date on every run. Versions released on or after the date are kept, and a package with none keeps its most recent earlier version. The date can also be set in the requirements file. For CRAN and Bioconductor, --starting-snapshot can no longer be combined with --file-in. See Air-Gapped Installations.
#18820 Added cran (R) and pypi (Python) repositories on first startup for new installations; [Repos] also offers commented-out Bioconductor and OpenVSX entries. Comment out or rename any of them in rstudio-pm.gcfg. Existing installations are unaffected. Package Manager logs a warning and skips a repository the license does not permit.
#18820 The default rstudio-pm.gcfg now documents common settings inline, with descriptions, reference links, and defaults or examples, including [Repos] startup repositories.
#18937 --snowflake-connection is now optional for rspm login and rspm login sso against Snowflake. Package Manager uses SNOWFLAKE_DEFAULT_CONNECTION_NAME or default_connection_name, and fails with a clear message when neither resolves.
#18644 #19197 Package details now show dependencies for every PyPI package version, including older and pinned snapshots and air-gapped deployments.
#19158 Local and Git Python package detail pages now show dependencies for every version, not just the most recent one.
#19137 Python package listings and search results now show each package’s license and release date.
#19367 Curated PyPI package listings and search results now show each package’s license and release date, matching the full PyPI mirror. Existing curated PyPI sources pick this up automatically the first time they are accessed after upgrading.
#19368 Added licenses and release dates for local and Git Python sources to PyPI listings and search. Migration.SkipPythonLicenseCapture skips the first-start capture of packages uploaded before the upgrade; they stay without a license or release date until you disable the setting and restart.
#19076 Package Manager no longer writes cached R package listings to disk, reducing cache cleanup work. Package listing and filtering are faster and use less memory.
#19494 The PyPI simple index now publishes file upload times and sizes, so uv --exclude-newer works. Mirrored packages report the upload time from PyPI; local and Git packages report when Package Manager received or built them. Files added before Package Manager recorded upload times remain excluded by --exclude-newer.

Server & Storage

#19486 Package Manager now warns when unresolved LinkingTo dependencies prevent serving a binary, naming the package and the dependencies, and records ppm_graph_ash_unresolved_deps_total. Each package is logged once per server process.
#19076 Added a single overwritten cache object per binary index platform cell. The retired cache reached 16,456 objects and 83.1 GB in production. Existing cache objects are left for normal cleanup. Server.BinaryIndexMemorySize bounds the memory it uses, defaulting to 1 GB.
#19242 Server logs now use structured attributes such as error=, path=, and manifest_type=. Log levels and content are unchanged. Tooling that matches exact messages may need updated patterns.

Fixed

#19541 Fixed an issue where a crafted version query parameter on a package request could write files outside the cache directory. Affected 2026.06.0 and earlier.
#18342 Fixed rspm update for a curated CRAN source in non-strict mode aborting when a requirement was unavailable at the selected snapshot. It now installs the valid packages and reports the rest as warnings. It still fails when no requirement resolves, and for strict and no-archived sources.
#19539 Fixed the package details page omitting binary availability, download links, and distribution selection for Bioconductor packages. The selected Bioconductor version now sets the R version, which cannot be chosen separately. Annotation, experiment, workflow, and book repositories are still served from source.
#19540 Fixed the binary availability APIs reporting a binary for a Bioconductor package that cannot be served as one, producing HTTP 404 on macOS and Windows and a silent source fallback on Linux. They now report none, and their MCP tools accept bioc_version, which Bioconductor repositories require.
#19404 Fixed server stalls when first serving unloaded Bioconductor version data, which could delay repository updates and unrelated requests for minutes.
#19396 Fixed license blocklist rules not matching Python packages that use PEP 639 License-Expression without a License :: classifier. Administrators using license-based blocklist rules must review which packages their repositories serve after upgrading: a package served despite a matching rule is now blocked. To block a specific older release, match package name and version.
#19457 Fixed filter/packages reporting PyPI mirror and curated PyPI packages as not blocked by license and age rules, and reporting no license for them, though downloads enforced those rules.
#19390 Fixed Python package details pages showing UNKNOWN for a license declared with PEP 639 License-Expression and no License :: classifier.
#19368 Fixed package listings, including the filter/packages API, reporting local and Git Python packages as available when license or minimum-age rules block their downloads.
#19154 Corrects PyPI GNU classifier licenses: LGPLv3 resolves to LGPL-3.0-only instead of LGPL-3.0-or-later, and versionless GPL and LGPL resolve to Unknown instead of a fabricated version. --license-types=Unknown now matches them. License expressions separated by non-ASCII whitespace are now parsed correctly.
#19432 Fixed slow binary index requests and package downloads in air-gapped installations, which re-checksummed the binary index, up to about 12 MB, on every request and the whole package file on each uncached download.
#19426 Clarifies that Offline Downloader --file-in requirements files define the complete repository, not packages to add. Restoring the complete file and downloading again recovers omitted packages without retransmitting package files that are already present. This applies to CRAN, Bioconductor, Python, and Open VSX. See Air-Gapped Installations.
#19405 Updates air-gapped storage guidance: CRAN requires about 170 GB, rather than 120 GB, and documents Offline Downloader --skip-source for adding binaries to existing source packages.
#19364 Air-gapped installations now show dependencies for every Python package version. Re-run get pypi to add this information to an existing dataset.
#19356 Fixed Offline Downloader get cran --skip-source, which previously still downloaded every source package. It now skips source packages while downloading the manifest, metadata, and binaries.
#19355 Fixed Offline Downloader datasets created with get cran --include-binaries, which served binary packages from source. Re-run get cran --include-binaries for existing datasets. --file-in datasets were unaffected.
#19433 Fixed stale binary package data when the manifest service returns no ETag header, as older JFrog Artifactory versions do. Updates took 24 hours to appear and nodes could not share cached data. An origin sending only Content-Length keeps the 24-hour window for same-size changes.
#18715 Binary package builds now resolve the system dependencies for several packages that under-declare them in their SystemRequirements (Rmpi, tkrplot, Rhdf5lib, pqsfinder, SICtools, HilbertVisGUI), so their binary packages build successfully.
#17064 The Setup page URL now identifies the manylinux glibc 2.28+ distribution as manylinux_2_28 rather than centos-8.
#19439 Requests abandoned while waiting for source or binary PACKAGES or archive.rds indexes now release server resources immediately. Index builds continue and remain cached.
#19076 Fixed binary package index requests to unupgraded nodes stalling 65 seconds during cluster rolling upgrades and then returning a misleading missing-cache error. They now fail immediately with a clear, retryable error. The condition resolves once every node has been upgraded.
#19341 Fixed an issue where interrupted package lists could be cached as complete and make repositories appear to miss packages. Interrupted requests now fail and retry.
#19324 Fixed an issue where Package Manager could stop responding to requests for every repository shortly after a source finished synchronizing, requiring a restart to recover. This occurred only under concurrent load, in the moments right after a synchronization.
#19298 Fixed an issue where a stalled request could block affected repositories after synchronization, requiring a restart. Stalled requests are abandoned, preserving previously synchronized data.
#18494 Deleting a source now frees its in-memory package graph immediately instead of retaining it until the next restart.
#19002 Fixed a goroutine and database-connection leak in package detail requests for Git and local sources that could exhaust the database connection pool and hang the server.
#19008 Fixed a goroutine leak when abandoned asset-polling requests left background goroutines blocked indefinitely, accumulating under heavy load and degrading the server.
#18679 Fixed a rare server crash when a package request overlapped with a CRAN or Bioconductor sync.
#18897 Fixed a resource leak where a client disconnecting mid-response from the package filter API for an Open VSX repository could leave server-side work running, which over many interrupted requests could gradually consume server resources.
#19220 Errors from the automatic repository syncs that run at server startup are now logged. Previously a failed startup auto-sync was silently ignored, leaving no trace in the server logs.
#19201 Curated CRAN repositories now include dependencies for every served package version, preventing missing-dependency installation failures under older R versions. Existing repositories are corrected automatically on upgrade; no update or rebuild is needed.
#18714 Fixed the JSON package listing API for curated CRAN repositories so an archived package reports the version the repository actually serves rather than the newest version from the underlying CRAN source. Package installation was unaffected.
#18874 Curated CRAN package history now shows the full version timeline (including previously served versions and their dates), matching CRAN and CRAN-snapshot sources.
#18930 Curated CRAN package history now lists every version served at each snapshot. Non-strict sources list the full archive; strict sources list only rolled-through versions.
#18930 CRAN and CRAN-snapshot package history now lists every version served at each snapshot, with the headline version current on that date.
#18971 CRAN-snapshot package history no longer shows snapshots newer than a source’s pinned date.
#19368 Package cards now describe Python packages released today as “today” and those released the day before as “yesterday”.
#19369 Fixed Python version constraints with full pre-release spellings, such as ==1.0alpha1, ==1.0-beta2, and ==1.0preview1, silently matching no versions with no error. They now match named versions.
#19291 Package detail pages for locally uploaded and Git-built Python packages now load substantially faster, especially for packages with many versions.
#19348 Fixed Requires-Python in the PyPI Simple index. All Python repositories left < and > unescaped, and local and Git Python packages emitted malformed markup that clients read as empty, so pip installed incompatible distributions. Existing packages are corrected automatically, with no re-upload.
#19340 Fixed Python package dependency links when metadata separates the package name and version specifier with a space.
#19331 Fixed Python package README API requests that failed with an internal error. They now return a clear “not found” response.
#18759 Python (PyPI) package listing, search, and popular-packages operations respond faster and use less memory, now served from a resident in-memory index. The package filter API no longer builds a per-request result-set cache, reducing its memory use.
#19487 API requests unsupported by a repository type now return an explained status: 400 Bad Request when the package releases API is asked about a repository that does not serve Python packages, and 501 Not Implemented from the vulnerability listing API for curated and local Open VSX sources.
#19488 Documents Server API pagination: page with _page and _limit. Package Manager ignores a parameter it does not recognize, so a request that pages with page or per_page silently returns the first page and reports success. _page=0 and _page=1 both return the first page. See Server API Guide.
#19406 Fixed repository-type URL errors, which now state the repository type, requested URL type, and the URL that serves packages.
#18530 Fixed an issue where local-plugins and git-plugins agent-plugin sources could not be renamed via the API or CLI, even though every other admin-named source type could.
#19219 Fixed an issue where the Package Manager UI’s SourceType enum had drifted out of sync with the server after a new source type was added.
#18785 The license expiration warning banner now uses an opaque background so its text stays legible when page content scrolls behind the sticky banner.
#18534 On the homepage, pressing Escape in the package search field now only closes the type-ahead dropdown. Typing again reopens it, so you no longer have to click out of the field and back in to keep searching.
#15500 Fixed a missing or inaccessible repository link sending you to another repository. It now shows a “Repository Not Found” page that tells you to sign in with the correct account.
#17731 OpenVSX Setup now lists “Positron or VS Code on Posit Workbench” first, followed by “Positron on desktop” and “Other VS Code compatible editors”.
#18989 Fixed failed VS Code extension uploads that left subdirectory icon files in storage.
#19252 Open VSX type-ahead suggestions now open the extension’s publisher.name page and show its display name with the publisher.name identifier.
#18501 Mistyping a subcommand under an rspm grouping command (such as rspm create git-builde) now reports the unrecognized command with a “Did you mean” suggestion, instead of a misleading “unknown flag” error pointing at an unrelated flag.
#18499 rspm CLI output now uses repository- and source-specific nouns for extensions and plugins in list, remove, and build messages. JSON output is unchanged.
#18509 Fixed rspm login sso --snowflake-connection failing to read a connections.toml or config.toml that carries a top-level default_connection_name, which failed to parse with cannot decode TOML string into ... Connection and made keypair authentication unusable.
#18892 The Debian/Ubuntu package now declares its libcap2 dependency, so the bundled license manager starts on minimal systems.

2026.06.0

June 30, 2026

New

Agent Plugins

#17891 Posit Package Manager can now host and distribute AI agent plugins. A new plugins repository type aggregates plugins from local uploads and mirrored git repositories and serves them over a read-only Git endpoint, so Claude Code, VS Code, and npx skills can install them from a Package Manager URL with no additional tooling. AI agent plugin hosting is an experimental feature, off by default. An administrator enables it on the Experimental Features settings page or with rspm config experimental enable agent_plugins.
- See the Admin Guide for more information on how create an agent plugin repo with local and Git plugin sources.
- See the User Guide for more information on how to use agent plugins with existing AI tooling.

Redesigned Homepage

#18261 Redesigns the Package Manager homepage with refreshed branding, a cleaner layout, and a faster way to find what you need. Highlights:
- Search is front and center, with type-ahead suggestions to jump straight to a package or repository.
- Browse repositories in list, grid, or grouped views, with favorites pinned to the top.
This is part of an ongoing investment in a modern, polished Package Manager UI, with more improvements planned in upcoming releases. See the User Guide for an overview of the new navigation.
#18987 The header adds a Documentation menu (open-book icon, left of the user menu) that consolidates What’s New, Admin Guide, User Guide, and Server API Guide, keeping the footer focused on Terms and Release Notes. The homepage marketing sections are reordered around the redesign’s Posit Team story: the closing Better Together block now sits at the bottom with copy aligned to posit.co/products/enterprise/team, and a new posit::conf(2026) block invites administrators and users to the annual R and Python conference.
#18240 The Package Manager documentation site now uses the refreshed Package Manager product mark in the navbar and a shortened “Package Manager Documentation” title, matching the cross-product docs branding rolled out on Workbench and Connect.

Experimental Features

#18048 Package Manager now supports experimental features, which are administrator-enabled previews of in-progress functionality. They are not guaranteed to be stable and may change or be removed in future releases. Enable or disable them from the new Experimental Features pane in the administration dashboard, or with the rspm config experimental CLI commands, without restarting the server.

Packages & Repository

#18410 Added rspm check-config, a new subcommand that validates the configuration file for syntax errors, unrecognized section or variable names, required file paths, database connectivity, and license status without starting the service or creating any data directories. It reports a [PASS] or [FAIL] result for each check and exits non-zero if any check fails. The run-diagnostics script includes its output, and the server suggests running it when startup fails due to a configuration error.
#18237 Added a blocklist rule criterion that blocks package versions until they reach a minimum age (a cooldown on newly published versions).
#18309 Package Manager builds its in-memory package graph substantially faster at startup and after CRAN and Bioconductor syncs, so repositories become ready to serve sooner.
#18309 #18313 #18335 Performance improvements to package serving. Repositories become ready to serve sooner at startup and after CRAN and Bioconductor syncs, and package requests stay fast under heavy concurrent load.
#16859 Package index files (PACKAGES, PACKAGES.gz, PACKAGES.rds) are now served directly from the in-memory package graph instead of an on-disk cache, improving multi-snapshot throughput and eliminating on-disk index growth. Note: when Server.MemoryCacheSize is set to 0 (in-memory caching disabled), these index files are generated on demand for each request rather than served from a cache, so deployments that set MemoryCacheSize = 0 to conserve memory may see higher CPU and latency on index requests.
#18342 rspm update for a curated PyPI source no longer aborts when the requirements file contains a package that isn’t available at the selected snapshot. Valid packages are still installed, and the unresolved entries are reported as warnings in the command output. The update still fails if no packages can be resolved.

VS Code Extensions

#18311 Added a --namespaces flag to rspm create blocklist-rule for blocking Visual Studio Code extensions via publisher namespaces (e.g., --namespaces=ms-python blocks all ms-python.* extensions). Allows multiple comma-separated namespaces (e.g., --namespaces=ms-python,GitHub blocks both publishers) and can be combined with --exception to create allow lists.
#17881 The OpenVSX search results page now displays each extension’s publisher.name identifier (for example anthropic.claude) under the extension title, making it easier to disambiguate similarly named extensions. The identifier is highlighted with the rest of the search term matches. Also adds emoji support in the READMEs.
#18110 Curated VSX sources now automatically resolve and include the transitive dependencies and bundled extensions of allowlisted VS Code extensions.
#18090 rspm update for a curated VSX source no longer aborts when the requirements file contains an extension that isn’t in the OpenVSX manifest. Valid extensions are still installed, and the unresolved entries are reported as warnings in the command output.

Authentication & SSO

#16123 Documents single sign-on (SSO) authentication for R workflows using pak 0.10.0 or later. R users can authenticate to Package Manager repositories configured with OpenID Connect via the native SSO support in pak, mirroring the rspm login sso and Python posit-keyring flow.

API

#16418 Documents the /url endpoint in the Server API Swagger documentation. This endpoint validates source-transaction pins and returns encoded URLs for configuring reproducible package repositories.

Server & Storage

#17889 Added Prometheus metrics for cluster health (ppm_cluster_state, ppm_cluster_integrity_check_failures_total, ppm_cluster_last_task_run_timestamp_seconds, and ppm_cluster_last_successful_ping_timestamp_seconds) so operators can alert on a missing leader, stalled scheduled work, or a degrading cluster.
#17889 Added an opt-in /__cluster-health__ endpoint that returns HTTP 503 when the cluster leader has been failing integrity checks for longer than Cluster.HealthCheckTimeout (default 60s, 0 to disable), so a load balancer or orchestrator can restart or drain a stuck leader.

MCP Server

#18187 Visiting the /mcp endpoint in a web browser now shows MCP setup instructions instead of a 405 Method Not Allowed error.
#17670 The get_server_info MCP tool now returns a server_url field, so AI agents can reliably determine which Package Manager server they are connected to.

Documentation

#18224 Added Posit Team installation order guidance to the installation documentation, noting that Package Manager must be installed and configured first when Connect and Workbench use it as their package repository.
#18223 The reference architecture and installation documentation now include a callout reminding administrators to configure proxy settings when running Package Manager behind a load balancer or reverse proxy.
#18213 The reference architecture documentation now states that Package Manager requires its own dedicated server and must not be co-located with other Posit products in production.
#18231 Documented the rspm sync --type=vulns CLI flag in the command’s help output, examples, and the air-gapped administration guide.
#18099 Added CLI examples for creating custom tabs to the rspm create metadata --help output and to the Custom Tabs user guide, showing how to add, update, and remove custom tabs at different scopes.

Fixed

#18385 The VS Code Gallery API (/vscode/gallery/extensionquery) responds substantially faster under load, especially when browsing Open VSX extensions by category. Package Manager no longer rebuilds and re-sorts the entire Open VSX catalog on every request, reducing both response time and memory use.
#18621 Fixed an issue where a Bioconductor repository’s archive.rds index included archived packages from every Bioconductor sub-repository instead of only the requested one. Each sub-repository’s archive.rds (for example data/annotation) is now scoped to that sub-repository, matching how its current PACKAGES index is scoped.
#18592 Fixed an issue where selecting a frozen snapshot date on a curated VS Code extensions repository’s setup page failed with an “unknown source type” error, leaving the setup instructions unable to load. Frozen snapshot URLs now resolve correctly for curated VSX repositories.
#18040 Fixed an issue where changing the DataDir or PostgreSQL configuration caused an inadvertent encryption key rotation, resulting in a startup failure (failed to decrypt OIDC key). Package Manager now automatically generates a new key instead of crashing.
#18453 Fixed an issue where requesting information about a package version that is no longer current — a package removed from its repository, or an older archived version of an existing package — could make a /filter/packages request hang for up to 60 seconds and then return an empty response. Such requests now complete promptly: in a request for multiple packages the affected packages are skipped and the rest are returned, and a request for a single such package fails fast with an error.
#18383 Fixed an issue where an R package dependency expressed with an exact-version constraint (for example pkg (== 1.2.3)) lost its operator and version in dependency-resolution details. Such constraints are now reported correctly.
#18231 Fixed an issue where a missing or corrupt vulnerability data file (for example after an offline data bundle version mismatch) could make the /vulns and /filter/packages endpoints hang for up to 60 seconds and return errors — even for ecosystems whose data had loaded correctly. Vulnerability data now syncs in the background instead of blocking requests, and an ecosystem whose data is unavailable is skipped (its packages temporarily report no vulnerabilities) rather than failing the entire request #18232.
#18335 Fixed a rare crash that could occur when package requests arrived while a source was being synchronized.
#17917 The OpenVSX gallery /vscode/gallery/{publisher}/{name}/latest endpoint now returns only the single latest version of an extension (with all of its platform-specific builds) instead of every version, matching open-vsx.org’s behavior and reducing response size.
#16756 Fixes binary package requests returning the wrong version for R packages with special paths.
#17889 Fixed an issue where, after a database failover such as an AWS RDS maintenance window, a multi-node cluster could stop running scheduled tasks (package syncs, builds, and cache eviction) and never recover. The cluster leader now steps down after a sustained loss of cluster integrity so that a healthy node takes over.
#17889 Fixed an issue where a transient loss of the database connection (for example during a database failover) could cause Posit Package Manager to shut down instead of reconnecting once the database became available again.
#18135 Generic OIDC clients that authenticate via standard discovery can now use Package Manager’s device authorization flow (RFC 8628). The .well-known/openid-configuration document advertises device endpoints that respect the configured device authentication provider, PKCE is now optional on the device flow, and the token endpoint returns a usable Package Manager API token as access_token when the standard urn:ietf:params:oauth:grant-type:device_code grant type is supplied. Existing first-party clients are unaffected.
#18192 Documents how to configure Posit Connect to install Python packages from Package Manager using uv or pip.
#18193 Preferences: Browse Color Themes in Marketplace (and the icon-theme equivalent) populates in Positron and other VS Code clients backed by Package Manager. The gallery serves extension web resources through the resourceUrlTemplate mechanism. If you run your own Package Manager instance, update your editor’s extensions gallery configuration with the resourceUrlTemplate setting from your repository’s Setup page.
#18188 Fixed the Binary File section’s placeholder message on the package detail page to use consistent styling with the System Requirements section.
#17299 Package list responses no longer include a zero-value id: 0 field for packages from mirrored sources (CRAN, Bioconductor, PyPI, OpenVSX).
#18346 Fixed an issue where local-python, local-vsx, git-python, curated-pypi, and curated-vsx sources could not be renamed via the API or CLI, even though they are admin-named source types.
#18413 Fixed an issue where creating a blocklist rule with an explicitly empty criterion (for example --package-name="") silently dropped that criterion. Combined with another scope such as --source, this could widen the rule to block an entire source instead of a single package.

Deprecated/Removed

#18220 Package Manager no longer updates the precompiled binary packages for Debian 12 (Bookworm), which has reached vendor end of support.

2026.05.0

May 29, 2026

New

Web Interface

#17320 Redesigns the package details page across R, Bioconductor, Python, and Open VSX repositories. Each ecosystem now shares a consistent two-column layout — a sidebar of at-a-glance facts (publisher, license, downloads, supported platforms) alongside a main column of expandable sections (README, dependencies, distributions, vulnerabilities, history, metadata) that persist their open/closed state across page refreshes. Highlights:
- Inline SHA256 with a one-click copy button on every Python distribution row, replacing the previous hash dialog.
- Distinct visual treatment for blocked (error palette) and yanked (warn palette) distributions, with status badges and inline hashes available on both.
- Security Vulnerabilities section auto-expands on blocked packages so the reason is visible without an extra click.
- Version selector inline with the package name on R / Bioconductor pages for switching between architecture-pinned variants.
- ORCID and ROR-aware author parsing so individual contributors and organizational publishers (e.g., Posit, PBC) surface as clickable links.
- Version History snapshot cards now surface a per-snapshot change description provided by the backend.
- Integrated Readme in overview tab to highlight developer notes.
- Accessibility pass across the redesigned list, details, and modal surfaces: every interactive element is keyboard reachable (including in Safari without the “Use Tab key” preference), expand/collapse controls expose aria-expanded/aria-controls, dialogs announce themselves as such with accessible names, copy actions emit live-region confirmations, decorative icons are hidden from screen readers, and the Other Versions accordions no longer nest interactive children inside their headers.
- Keyword chips now respect comma-vs-space-delimited inputs. Packages that publish their keywords as a comma-separated string (e.g. "machine learning, data science") preserve multi-word phrases as single chips; packages that publish keywords as a space-delimited string (some R / Bioconductor bioc_views lists) are split into separate chips instead of rendering as one long chip. Affects both the search results card and the Keywords sidebar on package details.
- Corrected the PyPI package details “Platform” row, which previously displayed Python interpreter tags (e.g. cp310, py3). The sidebar now shows a “Python Tag” row for the interpreter/ABI and a separate “Platform” row whose values are parsed from each wheel’s filename (e.g. manylinux_2_17_x86_64, macosx_11_0_arm64, win_amd64, any).
#17207 Redesigned and enhanced package search results page. Search term is highlighted and each item contains status badges (blocked, archived, yanked, vulnerability count), publisher or author, license, download count, publication date, and keyword chips.

VS Code Extensions

#17755 Adds curated VSX sources, allowing administrators to define an allowlist of VS Code extensions served through a curated repository.

Packages & Repository

#17627 Adds support for Ubuntu 26.04 (Resolute Raccoon).
#17475 Adds support for R 4.6 binary packages.

API

#17851 Surfaces archival status of Bioconductor releases through the bioc/versions API. When Bioconductor archives a release upstream, the archived field is set to true on the corresponding entry returned by the endpoint.
#17568 Adds field-level descriptions to API response types in the Swagger documentation, making it easier to understand API responses.
#17781 The repository setup page now recommends configuring Posit Connect via rstudio-connect.gcfg and the Package Manager Integration, matching Connect 2026.05.0’s new capabilities. Replaces the previous pip.conf / uv.toml and static-token netrc instructions for the Python and R Connect environments.

Fixed

Web Interface

#17967 Fixes the package History tab returning an invalid transaction error when clicking “View Snapshot Packages” for PyPI versions uploaded before the repository’s earliest snapshot. The link now points to the first snapshot where the package was observed by PPM.
#17985 Fixes inconsistencies in the package History tab for PyPI repositories. Versions that were never the served-latest are now labeled “Added” and link to a snapshot URL where the version is actually available, and a higher pre-release (e.g. 6.0rc1) no longer outranks a lower stable release (e.g. 5.0) when picking the latest. Timeline dates also now reflect when each version first became the latest in the repository rather than the most recent observation of that state, which removes spurious gaps between rows.
#17968 Fixes the package History tab showing an inconsistent source label on a snapshot row in a combined repo when a non-aliased source was subscribed after one of its packages had already been uploaded to the source. The snapshot’s change description and source list now agree.
#17609 Fixes a Token Management UI bug where choosing an expiration date in a timezone behind UTC could create a token that never expired. Expiration dates are now interpreted in local time and validated to be in the future.

VS Code Extensions

#17987 Fixes the Open VSX changelog parser for extensions whose CHANGELOG.md uses release-please-style markdown link headings (e.g. ## [2.4.2](compare-url) (2025-04-17)), major versions at # depth, or human-readable dates such as September 8th 2025. Previously affected extensions like Block Sort and Red Hat Dependency Analytics had missing release dates and dropped entire major-version entries.
#17613 Fixes VSX gallery API returning empty assets for extensions that do not have those assets.
#17613 Fixes empty tabs (i.e. Changelog) rendering in Positron or VS Code when used with PPM.
#17793 Fixes running rspm add on a local VSX extension twice with flag --succeed-on-existing corrupting the extension
#17820 Fixes OpenVSX extensions marked as “preview” by their author not exposing the preview flag through the VS Code Gallery API.
#17993 Fixes VSX gallery CORS allow-list missing VS Code client headers (X-Client-Name, X-Client-Commit, X-Client-Version, X-Machine-Id), which prevented Positron’s “Browse additional color themes” picker from loading themes hosted by PPM.
#17901 Fixes Open VSX extension versions being sorted incorrectly in the Package page and Server API.
#17872 Fixes the “Verified Publisher” badge not appearing in the package web UI for locally uploaded VS Code extensions.

Packages & Repository

#17780 Fixes binary download URLs for R packages with a non-default Path: (e.g. Transit) on macOS and Windows, which previously caused installer commands to hit 404 errors. Linux URLs already included the path segment; the same handling now applies to all operating systems.
#17348 Fixes vulnerability and Open VSX sync not using Manifest.User and Manifest.Password credentials for Basic Authentication.
#17859 Fixes issue returning stale Bioconductor manifest information.

Authentication & SSO

#17618 Fixes the logout flow to always redirect to the configured Package Manager landing page rather than honoring an externally supplied redirect target.

Server & Storage

#17944 Fixes broken support for S3 backed storage with buckets that have Object Lock enabled

CLI & Diagnostics

#17651 Fixes malformed output from rspm list blocklist-rules when a rule combined deleted-package criteria with other criteria, which previously ran multiple fields together on a single line.

Documentation

#18039 Fixes the Positron setup wizard instructions: removes a misleading reference to public Posit Package Manager on self-hosted instances, adds a copy-paste settings.json snippet for Positron configuration, and adds Positron-session coverage to the Posit Workbench instructions for both R and Python.

2026.04.2

May 07, 2026

New

#17628 Open VSX extensions returned by the VS Code Gallery API are now sorted by download count (most popular first) by default, with alphabetical tiebreaking, matching the ordering used by Open VSX.

Fixed

#17930 Updates in-product license messages to point to current Posit URLs and offer additional sales channels (sales@posit.co or posit.co/schedule-a-call). Fresh-install messages now direct users to posit.co/trial-license for a free 30-day trial. Removes broken legacy reference to apps.rstudio.com/trial-activation/.
#17916 Fixes VSX gallery API returning extension versions in ascending order instead of descending, which prevented Positron from detecting available extension updates.
#17901 Fixes VSX extension versions being sorted incorrectly in the packages API and web UI.
#17899 Fixes Open VSX extension lookup by UUID in the gallery API, which affected searching extensions by ID, installing or updating extensions, and viewing extension details in Positron/VS Code.
#17637 Fixes extensions deleted upstream from Open VSX continuing to appear in package listings and remain downloadable. Navigating to a deleted or nonexistent extension now shows a “Package not found” message, and deletions remain visible in the activity log.

2026.04.1

April 17, 2026

Fixed

#17690 Restores the /repos/{repo}/vulns API endpoint that was removed in 2026.04.0. This endpoint returns a list of package vulnerabilities for a repository.
#17736 Fixes license-manager failing to find its binary on x86_64 RPM distributions (RHEL 9/10, openSUSE 15.6+). A missing architecture detection call caused the installer to select the wrong distro-specific binary at runtime.
#17743 Fixes the Cloudsmith-based install and upgrade commands in the admin guide. The documented dnf commands used = for version pinning (e.g., dnf install rstudio-pm=2026.04.0), which dnf does not support; the commands now rely on the Cloudsmith repo to serve the correct version. apt and zypper commands continue to use =.
#16787 Fixes a rare issue where Bioconductor package pages could fail to load, with “pin mismatch” errors in the server log. A sync for one Bioconductor version could overwrite cached data for other Bioconductor versions, causing the same errors fixed in 2026.04.0 to recur. If affected on a previous version, restarting Package Manager will resolve the issue until the next occurrence.

2026.04.0

April 09, 2026

Breaking

#17043 The /filter/packages API endpoint request body field vulns has been renamed to has_vulns and metadata has been renamed to has_metadata for clarity.
#17325 CRAN and Bioconductor snapshots will no longer be generated after the 2026.04 release for PPM versions older than 2024.04.0 (CRAN) and 2024.08.0 (Bioconductor). These versions introduced an improved sync format (RSF) that replaced the legacy sync mechanism. Syncing on older PPM versions will continue to work, but no new snapshots will be available, so CRAN and Bioconductor data will become increasingly outdated. Customers on affected versions should upgrade to PPM 2024.08.2 or later to continue receiving updates.
#16882 Removes the /repos/{repo}/vulns API endpoint. Use the /filter/packages API endpoint with has_vulns: true instead.
#17128 Fixes an issue where some error messages were logged at INFO level instead of ERROR level, causing messages like INFO Error verifying cluster integrity: node list length differs. to appear as informational.
#17434 Archived package installation commands now use remotes::install_version() instead of devtools::install_version(), which was deprecated in devtools 2.5.0.

New

VS Code Extensions

#16554 Adds support for VS Code extensions via Open VSX mirroring or locally uploaded extensions.

Web Interface

#17162 Redesigns the package browsing experience by separating the package search and package details into distinct pages:
- Search page (/repos/:repo/packages): Shows paginated results with Previous/Next navigation.
- Details page (/repos/:repo/packages/:name/overview): Displays package information with a “Back to List” button to return to search results.
- Unifies behavior across R, Bioconductor, and Python packages.
- Improves direct URL sharing and bookmarking.
#16466 Adds a new Admin Settings area in the web interface for managing administrative features. The initial release includes Token Management, providing a web UI to create, view, filter, sort, and revoke API tokens.
#16383 Adds a Version History tab to the package details page that displays a timeline of all versions across sources and snapshots in a repo. This helps users understand when each version became available and which snapshot URL to use for reproducible environments.
#16972 The Sign In button is now visible whenever authentication is configured (SSO or API tokens), even if no repositories require authentication. This allows users to sign in for the Token Management UI without needing an authenticated repository.
#17222 Adds Positron IDE as an environment option on the Setup page for both R and Python repositories, with instructions for configuring package sources via Positron settings and environment variables.

Authentication & SSO

#16641 Adds a new RequireAuthForUI configuration option for OpenID Connect that requires SSO authentication for all web UI access. When enabled, unauthenticated users are automatically redirected to the SSO login page. Repository access for package installation and Server API endpoints are not affected.
#16641 Users without configured scope mappings can now log in via SSO. Previously, users with no matching GroupToScopeMapping or RoleToScopeMapping entries received an error. Now they can authenticate and access unauthenticated repositories, which supports the new RequireAuthForUI feature.
#16818 Adds a new UseUserInfo configuration option for OpenID Connect that fetches additional claims from the OIDC UserInfo endpoint and merges them with ID token claims. This supports identity providers that put groups or roles in the UserInfo response rather than the ID token (e.g., Azure AD, Okta).

Packages & Repository

#15552 Adds support for the PEP 639 License-Expression metadata field for Python packages. When a package specifies a valid SPDX license expression (e.g., “MIT OR Apache-2.0”), it is now parsed and displayed as the package license, taking priority over legacy classifier-based license detection. This applies only to package versions released on or after February 25, 2026.
#16257 Adds support for serving precompiled binary packages for Debian 13 (Trixie).
#16649 Multiple newlines, tabs, and whitespaces are now being properly removed from the PACKAGES file.
#16792 New supported distributions and R versions are now synced every 6 hours instead of every 24 hours.

MCP Tools

Split the get_status MCP tool into three focused tools for better discoverability: get_server_info (version, feature flags, auth config), get_supported_distros (binary platforms, R versions), and get_bioc_versions (Bioconductor versions with R mappings and CRAN snapshots).
#16882 Adds a new filter_packages MCP tool that allows AI assistants to filter packages from a repository or source based on criteria like vulnerabilities, custom metadata, and version constraints.
#17079 Adds a new get_package_releases MCP tool that fetches lists of Python package releases for a specific package name and repository.
#17080 Adds Python package documentation support to the get_package_docs MCP tool, allowing it to retrieve and display documentation for Python packages in addition to R and Bioconductor packages.
#17082 The get_vulns_list MCP tool now supports pagination with limit and page parameters, and returns a total_count field for easier navigation of large result sets.
#17084 Adds a new get_repo_licenses MCP tool that aggregates license information across a repository, providing a summary of packages grouped by license with SPDX identifier standardization for R, Bioconductor, and Python packages.
#17290 The MCP server now operates in stateless mode, simplifying client integration by not requiring session persistence between requests.

Documentation

#16988 Updates installation documentation to recommend the Posit Package Repository as the primary installation and upgrade method, which automatically handles GPG key management and provides a simpler set of steps.

Fixed

Server & Startup

#17506 Fixes failed or partially downloaded packages from being marked as complete.
#16928 Fixes an intermittent startup error in cluster configurations where concurrent syncs could fail with duplicate key value violates unique constraint "server_settings_pkey" on the SYSREQS_LATEST_CHECKSUM setting.

#16835 Fixes various errors that could occur when starting Package Manager for the first time in a cluster configuration, such as:

Error running services: Error migrating ... ERROR: duplicate key value violates unique constraint "server_settings_pkey" (SQLSTATE 23505)

#16862 #17157 Fixes an issue where Package Manager could hang indefinitely on startup when refreshing supported distributions, particularly when an error occurred during the startup process. In previous releases, this can be worked around by adding the following to your configuration file and restarting the server:
```
[Distros]
AutoUpdate = false
```
#16689 Fixes a rare issue where Package Manager could hang when syncing vulnerabilities.
#16713 The /__ping__ health check endpoint now returns HTTP 200 even when the license is expired, allowing Kubernetes readiness probes to succeed so users can access the web UI and see the license expiration notice.
#16714 Posit Package Manager now starts successfully with [OpenIDConnect] or [IdentityFederation] configuration when the license does not permit OpenID Connect. The settings are ignored with a warning instead of causing startup failure.
#16341 Package Manager can now use an Azure service principal to authenticate to PostgreSQL.

Web Interface

#17583 Fixes a 404 “XSRF mismatch” error when viewing images in R package READMEs while signed in via SSO.
#16317 Fixes an issue where refreshing the Setup page could reset the selected binary distribution to “source” instead of preserving the user’s selection.
#16787 Fixes persistent “pin mismatch” errors when viewing Bioconductor package pages. A cache key mismatch caused RSF updates for Bioconductor sources to be silently skipped, leaving stale graph data until server restart.

API & Database

#17012 Fixes a crash in the package filter API when Server.UsageDataEnabled is set to false. The API now returns a clear error message asking users to either set omit_downloads to true or enable usage data.
#17164 Fixes a database migration failure when upgrading from PPM 2023.12 or earlier if the database contained very large queue failure addresses. The migration now uses a PostgreSQL hash index which has no size limit.

CLI & Diagnostics

#17155 Fixes the diagnostics script not including config files from /etc/rstudio-pm/ due to a hardcoded relative path.
#16764 The rspm encrypt command now correctly prints its input prompt when run interactively: Encryption: Enter the plain text value below..
#16554 Adds rspm CLI support for VS Code extensions:
- rspm create repo --type=vsx to create VS Code extension repositories.
- rspm create source --type=openvsx and --type=local-vsx to create mirrored or local extension sources.
- rspm sync --type=openvsx to sync extensions from the Open VSX registry.
- rspm add --source=<local-vsx source> --path=<file.vsix> to upload .vsix files to a local source.
- rspm remove --name=<namespace.name>@<version> to remove extensions from a local source.
- rspm list packages, rspm subscribe, rspm unsubscribe, and rspm info all support the new VSX source and repo types.

Documentation

#16994 Updates documentation and CLI examples to use --authenticated=true instead of --authenticated when enabling repository authentication, making it clearer that --authenticated=false can be used to disable authentication.
#14007 Documents missing Package Service Log properties for PyPI downloads: pypi_file class, sha256 field, and filename field.

2025.12.0

December 23, 2025

Breaking

#14714 Disables StorageAudit configuration by default. Storage auditing can experience performance issues when used with certain storage systems due to the network overhead of file system operations and is only relevant when using local storage (not NFS or S3). The config can be reenabled via:
```
[StorageAudit]
Enabled = true
```
#16698 PyPI simple index pages are now generated with relative paths by default instead of using the configured Server.Address. These pages only require the Server.Address setting if running Package Manager behind a reverse proxy at a sub-directory path (e.g. https://proxy.com/packagemanager/). No action is required in most cases. If using a reverse proxy, ensure it passes the standard X-Forwarded-* proxy headers and review the proxy documentation to ensure your deployment is configured properly.

New

#16460 Adds support for a Model Context Protocol (MCP) server, providing AI assistants a more reliable way to interact with package repositories programmatically. See the MCP Server documentation for more information.
#16390 Package Manager can now be installed for the ARM64 architecture on Ubuntu 24.04 (Noble) or Red Hat Enterprise Linux 10 (RHEL 10). The standalone rspm CLI tool and offline downloader are also available for ARM64 on any Linux distribution.
#16337 Adds support for OAuth2 federated credentials for Git builders. This provides modern, secure authentication using short-lived access tokens for Azure DevOps and Bitbucket repositories. For Azure DevOps, supports both client credentials flow using client secrets and federated identity using OIDC tokens with Microsoft Entra ID. For Bitbucket, supports client credentials flow using OAuth consumers. See the Git Credentials documentation for setup instructions.
#16364 Adds support for GitHub App credentials for Git builders. This provides an alternative to SSH keys and HTTPS credentials (Personal Access Tokens) for authenticating to GitHub repositories. GitHub Apps offer enhanced security through short-lived tokens, more granular permissions, higher rate limits, and better audit trails compared to traditional SSH keys or PATs. See the GitHub App Credentials documentation for setup instructions.
#16721 Adds support for SLES 15 SP7.
#16628 Added instructions for using uv to install Python packages from Posit Package Manager in the Setup documentation.
#16314 rspm list tokens now outputs the user value.
#16370 Improves PyPI simple package HTML generation performance by replacing file-based caching with ristretto in-memory caching and implementing streaming-based content delivery. This reduces disk usage in the pypi storage class and improves response times for PyPI package index requests.
#16507 Adds support to authenticate through the Posit Team Snowflake Native App with rspm login and rspm login sso using a new --snowflake-connection flag.
#16262 Adds dark mode toggle to PPM header and theme.

Fixed

#14822 Homepage is now displayed in the web UI for Python packages that specify their homepage using the Project-URL field.
#16343 rspm list now checks for invalid subcommands.
#16361 Improves detection at startup of when user namespace sandboxing is disabled for Git package builds.
#16483 Fixes an issue where Package Manager can’t add a package to a curated CRAN source if it was fully archived prior to approximately October 2017.
#16429 Fixes an issue where Package Manager would return archived packages in the archive.rds file from a lower priority source in a repository.
#16732 Fixes an issue where R package binaries could not be served in rare cases. For example, this prevented binaries from being served for Rcpp 1.1.0 and any directly dependent packages on December 8, 2025.

2025.09.2

November 3, 2025

Fixed

#16514 Fixes an issue where Package Manager has high CPU utilization when the product check configuration is enabled.
#16415 Fixes several issues related to blocklist rules created with --min-severity setting when using Postgres:
- Fixes an issue where creating and listing blocklist rules did not display --min-severity setting when using Postgres.
- Fixes an issue where blocklist rules created with any --min-severity value blocked all packages and versions when using Postgres.
- Fixes an issue where blocklist rules could not set --min-severity to a non-x.0 decimal value when using Postgres (i.e could create with 1.0 but not 1.1).
- Fixes an issue where blocklist rules setting --min-severity did not properly count x.y and x.z as unique when using Postgres (i.e 1.1 and 1.2 would be treated as the same).

2025.09.0

September 10, 2025

Breaking

#15747 Updates rspm_ Prometheus metric prefix to ppm_ and binary_ Prometheus metric prefix to ppm.binary_
#15396 Ubuntu 20.04 (Focal) has reached vendor end of support and is no longer supported.
#16039 The --user flag is now required when using rspm create token. This flag associates the token with a user or application name for better audit logging.

New

#15767 Adds support for single sign-on (SSO) authentication via OpenID Connect (OIDC), enabling integration with identity providers like Okta and Microsoft Entra ID. Advanced customers can now use SSO for user and group authentication, mapping to all Package Manager authorization scopes. SSO login is available via web browser, the Package Manager CLI, and tools like pip and uv for Python package installation. Client support for R package installation will be coming soon. See the SSO Authentication documentation to get started.
#14961 Portable Linux R binary packages are now available in public preview. These packages bundle system library dependencies for easier and more reproducible installation across many Linux distributions. To try them out, visit the Setup page, select manylinux glibc 2.28+ (preview) from the Linux Distribution dropdown, and follow the instructions to update your repository URL in R. For more information, see the documentation on Portable Linux Binary Packages.
#15612 CRAN binary packages are now available for select ARM64 Linux distributions (Ubuntu 24.04, RHEL 9, RHEL 10, and manylinux 2.28+) and R versions 4.1 through 4.5.
#15613 Adds a new R repository URL format for Linux that supports declaring the full package environment (distribution, architecture, and R version) as part of the repository URL itself: /bin/linux/<distro>-<arch>/<version>. For example, the URL to retrieve binary packages for Ubuntu 24.04 (Noble), on ARM64 architecture, for R 4.5 would be https://ppm-server/cran/latest/bin/linux/noble-aarch64/4.5. For the x86_64 architecture, the URL would be https://ppm-server/cran/latest/bin/linux/noble-x86_64/4.5.
#15975 Server.HTTPCacheControl default value has been set to max-age=3600.
#15715 Adds Server.HTTPCacheControl header for package downloads to better support CLI tools like uv.
#15335 Adds --min-severity and --block-unscored flags to rspm create blocklist-rule and rspm edit blocklist-rule to allow package blocking by CVSS score.
#15640 CVSS scores, if available, are now displayed in the vulnerability list and vulnerability info panel.
#15908 Adds a product check request that pings a Posit server when Package Manager is set up and using an active or trial license. This check helps us proactively support customers by confirming successful installation. This is controlled by the Server.ProductCheck configuration setting, default true. Server.ProductCheckFrequency configures how often this check is sent out, default 24h.
#15580 Adds in-memory caching for package download counts. This avoids cluttering the cache directory with files matching the *_DOWNLOAD_COUNTS_QUERY_* pattern.
#15585 When RetainFetchedPackages = no is configured in the Server, CRAN, Bioconductor, or PyPI sections, Package Manager avoids caching package metadata loaded on demand from the Posit Package Service. This is also the new default behavior for air-gapped environments. If you are using S3 for shared storage, consider setting Server.RetainFetchedPackages = no to reduce S3 usage/traffic.
#11806 Usage stats can be sorted by count via keyboard using tab/enter to navigate and toggle.
#15336 Alert banner is now easier to read.
#16012 Adds rspm login sso command for authenticating in the CLI with SSO.
#16012 Adds rspm login command for authenticating in the CLI with an API token.
#15723 Adds support for Red Hat Enterprise Linux 10 (RHEL 10).

Fixed

#7678 Fixes an issue where packages with the same name but different casing (e.g., mypackage and MyPackage) could result in duplicate package versions being shown in the UI and CLI, and prevent package details from appearing in the UI.
#15416 Fixes an issue where a snapshot synchronization race could result in caching outdated information.
#15630 Fixes an issue where python signature files were deleted from the cache, preventing python packages from being downloaded.
#15564 Suppresses user related (4XX) API errors in the server log.
#15564 Fixes an issue with displaying Git package details in the UI in rare cases.
#15806 Fixes an issue with panics occurring when encountering a filesystem error when calling the create packages API endpoint
#15824 Fixes an issue with the rspm edit repo command not checking for special characters in a repo name when editing a repo.
#15187 Fixes an issue with high memory usage associated with many concurrent requests for Python packages from Curated PyPI sources.
#15618 The run-diagnostics script no longer requires running as the root user.
#15860 Uses the configured Server.TempDir (which typically defaults to /tmp) when bind mounting the temp directory for sandboxing R processes.
#11880 Fixes incorrect binary URL generation for packages with special paths.
#16063 Fixes an issue where vulnerabilities were not reported for recent package versions in some cases.
#16130 Fixes an issue where R package system dependency information was not being updated after the initial sync. System dependencies are now properly updated during CRAN or Bioconductor synchronization. This issue affected both the “Install System Prerequisites” feature in the web UI and the rspm list requirements command in the CLI. For older versions of Package Manager, you can force a one-time update by running the rspm evict --type=clear command as a temporary workaround.
#16108 Fixes an issue where Package Manager served the wrong package version when installing archived CRAN binary packages older than approximately October 2017.
#16196 Fixes an issue where migrations from SQLite to Postgres could fail due to sorting inconsistencies during the verification step.

API Changes

#16059 The /filter/packages API endpoint now allows anonymous access when requesting information for an unauthenticated repo. Requests for information for a source or requests for an authenticated repo still require authentication.
#16059, #16115 The /filter/packages API endpoint now supports three new boolean parameters:
- #16059 Use omit_dependencies to omit package dependency information for better performance.
- #16059 Use omit_downloads to omit package download statistics.
- #16115 Use omit_package_details with R and Bioconductor repos or sources to omit available_versions output and avoid additional lookups for better performance. Note that using omit_package_details is only supported for adhoc requests where you supply a list of package names. Note also that version constraint ranges (e.g., plumber<1.0.0) may result in listing only package versions that appear in PPM snapshots since October 2017; older archived package versions may not be listed. We recommend using omit_package_details only with version equality constraints (plumber==0.4.2) or no version constraints (plumber).

2025.04.4

July 7, 2025

Fixed

#15918 Correctly ignores missing dependencies in Curated CRAN sources.
#15918, #15937 Fixes issues where package graphs connections could remain open permanently.
#15914 Fixes an issue where the CRAN manifest reader could remain open permanently during an rspm update command without a --snapshot parameter.
#15910 Fixes an issue where package graph connections remained open too long during requests involving R package binaries.
Fixes a few issues where a single request required more than one database connection at a time:
- #15937 Requests for Curated CRAN/PyPI sources could require more than one database connection at a time.
- #15937 The URL creation API used by the Package Manager Setup page calendar required more than one database connection at a time.
- #15937 Migrations of older Curated CRAN sources could require more than one database connection at a time.
#15937 Fixes an issue where requests for documentation or for the REST API were using a database connection unnecessarily.
#15937 Fixes an issue where requests for repos involving both Local and Curated CRAN/PyPI sources could hang when too many database connections were in use.
#15937 Fixes an issue where requests for repos involving both Bioconductor and Curated CRAN sources could hang when too many database connections were in use.
#15937 Fixes a bug with creating a custom PostgreSQL sorting collation on startup. This affected installations using PostgreSQL with a single database and separate schemas for main and metrics data.

2025.04.2

May 30, 2025

Fixed

#15716 Fixes an issue with dependency graph caching that could result in serving incorrect Curated CRAN and CRAN Snapshot package binaries.

Deprecated/Removed

#15716 Deprecates the Server.InMemoryPackageGraphSize and Graph.EvictionInterval settings. These settings will be removed in a future release.

2025.04.0

April 10, 2025

Breaking

#15486 The /filter/packages API endpoint now requires a global:admin, metadata:admin, or sources:write token scope for source based requests.
#14260 Curated CRAN sources now include dependencies for their suggested dependencies. Previously, there were some scenarios where Curated CRAN sources included suggested dependencies without including the dependencies of those packages.

New

#14954 Added support for authenticated repositories via Basic HTTP authentication. This feature allows you to create repositories that restrict access to users with an API token. See the Authenticated Repositories to get started.
#14193 Automatically rotate the encryption key and encrypted values with rspm encrypt rotate.
#15345 Added a --no-archived flag for creating Curated CRAN and CRAN Snapshot sources without archived packages.
#13345 Posit Package Manager documentation is now produced using Quarto.
#15223 The Server API Guide now automatically utilizes the API token from your web UI sign-in.
Updated to Golang 1.24.
#14196 Enabled operational metrics by default on port 2112, with the option to disable them by setting Metrics.Enabled = false.
#15365 Updated the R configuration steps for Linux binary packages when using the curl download method. Added curl flags to improve output, error handling, and support Package Manager instances using Manifest.AllowRedirect = true. If you are using curl on Linux, see Configuring the R User Agent Header for updated instructions.
#14260 Updated the way Package Manager calculates package dependency graphs for better performance, significantly reduced caching, and to avoid thrashing.
#14260 Adds first-class support for Enhances and RevEnhances when calculating dependencies. For example:
- Package eemR from CRAN should now include a link in Reverse Enhances in the Web UI to albatross. Previously, no Reverse Enhances links were shown.
- Package albatross from CRAN in the Web UI should include an Enhances link to eemR that is clickable. Previously, forward Enhances links were not clickable in the Web UI.

Fixed

#14820, #15437 Added core metadata 2.3 and 2.4 support for Python packages. This fixes an error with adding Git or local Python packages: path may not point to a valid Python package: metadata is missing required fields.
- If you are on Package Manager 2024.11.0 or earlier and cannot upgrade, you can temporarily work around this by pinning the build backend of your package to the latest version that uses core metadata 2.2 or earlier. These versions include:
  - setuptools==76.1.0
  - poetry-core==1.9.1
  - hatchling==1.21.1
- If you cannot modify the package or upgrade Package Manager, please contact Posit support for assistance.
#15119 API tokens can now be used as Authorization Basic headers with the __token__ user.
#14846 Bioconductor.SyncSchedule config setting removed.
#14907 Display better error when there are conflicting values for HTTP.Listen and HTTPS.Listen.
#14848 Fixed an issue where the Activity Log’s Package Versions header did not span all of its columns.
#12399 Fixed an issue with rspm CLI where a confusing error was displayed with an invalid license.
#14765 The Bioconductor repository URL on the Setup page no longer includes an unused /__linux__/ segment when a Linux distribution has been selected.
#5218 The system requirements API and CLI were updated to explicitly return an error when a request is made for a Python repository.
#14885 Makes the dependency lines included in PACKAGES and PACKAGES.rds more consistent.
#14899 Fixes an issue where the /filter/packages API missed including some dependencies for archived R packages.
#14928 Fixes an issue where legacy Curated CRAN sources with many updates were very slow to migrate.
#15128 Fixes an issue where requests for archived R package binaries from Curated CRAN sources resulted in source packages even when precompiled package binaries were available.
#15073 Fixes an issue where rspm test blocklist-rules command did not report R vulnerabilities for archived versions based on the repository name.
#15314 Fixes an issue where migrating Curated CRAN sources from previous versions could fail with an error ending with “error getting alias for macro transaction <number>: sql: no rows in result set”.
#15269 Fixes an issue that made all Bioconductor versions available even when Bioconductor.EnabledVersions was configured to restrict available versions.

Deprecated/Removed

#15485 The metadata:read token scope has been deprecated. Existing tokens with this scope can continue being used, but new tokens cannot use this scope. New tokens should use the repos:read scope instead.
#15450 Deprecates support for PyPI updates for Posit Package Manager versions prior to 2023.04.0. If you are using a Package Manager version prior to 2023.04.0, updates for PyPI repositories will soon be disabled.
#15244 openSUSE 15.5 and SLES 15 SP5 have reached vendor end of support and are no longer supported.
#15503 The precompiled binary packages for Debian 11 (Bullseye) are no longer updated as it has reached vendor end of support.

API Changes

The following API methods were removed:
- #15156 /sources/:source/vulns
- #15156 /sources/:source/vulns/:package
The following API methods now require authentication:
- #15156 /sources
- #15156 /sources/:source/packages
The following API paths changed:
#15156 /sources/:source/packages/:key/releases moved to /repos/:repo/packages/:key/releases
#15156 /sources/:source/transactions moved to /repos/:repo/sources/:source/transactions
#15156 /sources/:source/snapshots/:key/packages moved to /repos/:repo/sources/:source/snapshots/:key/packages
#15154 All API methods beginning with /repos/:repo that support anonymous access now support optional authentication with API tokens for repos that require authentication.
#15156 The /filter/packages API now supports authentication with API tokens with repos:read permissions when the repo request parameter is provided.

2024.11.0

December 4, 2024

Breaking

#13652 CentOS/RHEL 7 has reached vendor end of support and is no longer supported.
#14307 Changed swagger definitions and response types for creating and listing repos and sources, to avoid exposing internal struct types.
#14187 The configuration option HTTP.Listen will now default to :4242. Set HTTP.Listen to an empty value to disable HTTP server connections.
#13651 Deprecate the [Server].EncryptionKeyPath option in favor of storing the encryption key on the persistent storage location (s3 or file). An existing key will be migrated to the [Storage].Persistent location. Remove the [Server].EncryptionKeyPath setting after the key has been migrated to avoid warnings in the startup logs.

New

#14518 Introduces the first of a new set of features called Metadata Services, which allow you to enrich Package Manager’s built-in package information with your own information, like internal package scores, approval status, or even links to your own supplemental documentation. For more information on how to use custom metadata, refer to the documentation.
#14026 Adds support for openSUSE 15.6 and SLES 15 SP6.
#14320 Adds a command to the Bioconductor setup page to set the R_BIOC_VERSION environment variable for better reproducibility. This prevents BiocManager from automatically upgrading to a new Bioconductor version as soon as it’s released.
#7812 Our installation documentation now recommends using apt instead of gdebi to install Package Manager.
#14213 Python Git builders now build binary distributions (wheels) for Python packages if possible, in addition to source distributions. This may help prevent package installation failures using newer versions of pip that use build isolation, and speed up installations for packages with compiled code.
#14404 Document the rspm evict command types for more clear usage.
#14430 Adds new rspm encrypt generate command to create an encryption key manually before starting Package Manager.
#14431 Document how to edit the rstudio-pm.service configuration.
#14472 Adds a new PACKAGEMANAGER_PROXY_TOKEN environment variable for the CLI to set the Authorization and X-PPM-Authorization headers accordingly for proxied environments.
#14560 Adds the ability create blocklist rules based on a repository.
#3856 The UI now displays a single entry with a version selector when multiple current versions of a package exist in CRAN.
#13651 Handle generating and storing the encryption key automatically in the persistent storage location. The new location is /persistent/encryption/rstudio-pm.key at the [Storage].Persistent location. The original key remains backed up on the disk at the same location with the name rstudio-pm.key.bak.<timestamp_of_migration>.
#14816 Adds retry logic when connecting to a Postgres database to better handle failover scenarios.
#14403 Adds a Manifest.AllowRedirect setting to support 307 redirects to the underlying package repositories. This enables the ability for users to download packages directly from the Manifest.URL location without passing through Package Manager and caching locally.
- This can both significantly improve package serving performance and reduce storage usage.
- Note: the end user’s system needs outbound internet access to the Manifest.URL location (by default this is the Posit Package Service, http://rspm-sync.rstudio.com). This is not always feasible depending on the network configuration.
- Note: redirects are supported by both R’s install.packages() and the Python’s pip by default, but if using a non-default download method in R such as curl, you will have to add the download options to follow redirects for that particular method.
#14752 The run-diagnostics script now includes the output of the git-builds command.
#14488 Updates the recommended system requirements for Package Manager to 4 CPU cores, 16 GB memory, and at least 500 GB of storage. The previously recommended system requirements are now the minimum system requirements.
- The AWS reference architecture configurations have been updated to reflect the new recommended system requirements.
Updates the Reference Architectures documentation with new architectures for Microsoft Azure and more:
- #14250 Adds the Azure * Single Server architecture.
- #14612 Adds the Azure * Load Balanced architecture.
- #14251 Adds the Azure * Kubernetes architecture.
- #14270 Adds Generic Architectures for running Package Manager in a general architecture.
- #14451 Adds Architecture FAQs for frequently asked questions about the reference architectures.
- #14427 Adds recommendations for using Azure Files as NFS file storage.
Updated to Golang 1.23.3.

Fixed

#14219 Fixed an issue where Git-based packages did not load correctly after migrating to a Postgres DB.
- Please contact Posit support if you see messages like this in your server log after migrating to Postgres using an older Package Manager version: Unable to set Git Builder URL for Git package: sql: no rows in result set.
#14211 Fixed an issue where --succeed-on-existing flag for rspm create git-builder did not work.
#14192 Fixed an issue where excessive blank space could appear on the Usage Stats page in certain browsers like Chrome.
#14273 Fixed an issue that prevented retrieving archived packages from CRAN Snapshot sources migrated from Package Manager 2023.12 or earlier.
#14291 Fixed an issue with the R Package page loading slowly for packages with a large number of dependencies.
#14292 Fixed an issue with serving responses for missing Python packages when using S3 file storage. This could cause tools like uv to fail when installing packages in some cases.
#14292 Fixed an issue with missing Activity Log messages for curated CRAN sources when using S3 file storage.
#14321 Fixed an issue with rspm CLI error messages not appearing in some cases.
#14300 Fixed an issue that could cause binary package serving to fail when using a proxy or third-party integration, like Artifactory, in very rare cases.
#14390 Increases timeout to prevent intermittent “timeout waiting for macro transaction to open” errors.
#14339 Fixed an issue where the Postgres.UsageDataURL would default to the Postgres.URL, but the Postgres.UsageDataPassword would need to be configured separately.
#14420 Fixed an issue where the Database.Provider = postgres setting wasn’t accounting for case sensitivity resulting in errors that the commands are only available when using a PostgreSQL database.
#14254 CRAN snapshot dates now backdate to the selected Bioconductor date on the Setup page.
#14381 Fixed an issue with Package Manager hanging on startup if Server.TempDir was set to a directory mounted as noexec. If affected, the server log would have contained a message like this: Error: Unable to run an executable program within the Server.TempDir='/tmp'; this directory may be mounted 'noexec'.
#13132 Fixed an issue where the CRAN repository package count could be incorrect.
#14475 Fixed an issue where curated CRAN requirements containing a dash ‘-’ resulted in a failure.
#14485 Fixed an issue where an error during package updates could cause temporary files to accrue.
#14547 Broad encryption key file permissions now log a warning rather than prevent start-up.
#14733 Fixed an issue where the vulnerabilities endpoints were returning packages that were not available in the repository or source.
#14560 Fixed an issue where the PyPI simple package page could incorrectly reference the wrong repository.
#14503 Fixed a confusing rspm error where an invalid character ... looking for beginning of value. This will now output the body from the failed request.
#14690 Fixed an issue where the Postgres.UsageDataPassword was set, but the Postgres.UsageDataURL would not use the default Postgres.URL.
#14624 Fixed an issue where autosyncing Bioconductor would fail due to a missing version number.
#14628 Fixed an issue where a failed package update could get cached and require a server restart to recover.
#14606 Fixed S3Storage.Prefix handling by automatically stripping all leading and trailing slashes.
#14630 Fixed an issue where disabled vulnerabilities flag was not applied correctly.
#14726 Fixed an issue where Bioconductor packages with the same name but different versions could cache metadata incorrectly across Bioconductor versions.
#14845 Fixed an issue where the online, offline, and cluster online/offline commands failed when Package Manager was configured for PostgreSQL with a separate Postgres.Password setting.

2024.08.2

September 20, 2024

Fixed

#14408 Fixed a migration issue involving Bioconductor usage with Package Manager versions prior to 2021.09.

2024.08.0

August 09, 2024

Breaking

#13962 Bioconductor sources can no longer be created with the rspm create source command. Individual Bioconductor sources have been replaced with a single Bioconductor source that provides data for all Bioconductor versions. See the Quick Start guide for more information.
#13817 [Debug].Log has been deprecated and disabled, along with debug regions. See [Logging].SystemLogLevel for debug logging.
#13858 Systemd service file has been simplified due to logging changes. tee is no longer used to redirect logs to log file and PID file no longer used. See [Logging] section for logging configs.
#13817 rspm config debug logger has been updated. It is now rspm config log --level=[level] to set various logger levels.
#13805 The [Authentication].APITokenAuth setting is now enabled by default.
#13683 API endpoints now expect repository and source names instead of IDs. IDs are still supported for backward compatibility, but this may change in a future release. Using IDs instead of names may result in inconsistent output if any sources or repositories use numeric names.
#13404 Deprecates using rspm add to add packages to Curated CRAN sources. Use rspm update to add packages to Curated CRAN sources.
#13518 openSUSE 15.4 and SLES 15 SP4 have reached vendor end of support and are no longer supported.
#13681 The Swagger API documentation version will now match the application server version.
#13674 The Id in the transactions API will now be null for CRAN, PyPI, and other mirrored sources instead of 0.
#13701 Integers are no longer allowed as source or repository names.
#13933 New repository and source names may only contain the characters a-z, A-Z, 0-9, and ., ~, -, _.
#14010 The rspm url create command now requires the --date flag.

New

#13817 [Logging] section has been added to configure the system log output, format, and level.
#13643 Postgres installations no longer require a separate database for the usage data. The [Postgres].UsageDataURL field will now default to the configured [Postgres].URL.
#9905 Adds a new notification banner and prometheus metric for the number of days left until the product version is no longer supported. See the support configuration settings to tweak these options.
#13682 The Server API is now considered stable and generally available. While endpoints are still subject to change, breaking changes will be documented.
#13767 Adds a new flag option rspm evict --type=clear for immediate cache eviction.
#13799 Adds a new rspm bootstrap command for creating keypairs, and generating an admin token for remote management.
#13778 The entire admin CLI is now available for use remotely, with the exception of the offline, online and cluster commands. API tokens can be generated with the new global:admin scope to allow full access to the CLI. See the Remote Use documentation for more details.
The following commands can now be used remotely with the sources:write API token scope:
- #13592, #13779 rspm update and rspm add on curated CRAN, CRAN snapshot, and curated PyPI sources.
- #13780 rspm import to import a Git credential that can be used for any Git source.
- #13781 rspm remove to remove packages from a source.
#13954 Adds the rspm verify command to verify a connection to the server.
#13599 Adds the AppArmor profile for Ubuntu 24.04 and later versions, enabling the use of user namespace sandboxing for Git package builds.
#13947 Bioconductor sources now fully support date-based snapshots. Use the snapshot calendar on the Setup page to get a frozen URL for any Bioconductor packages. Bioconductor repos may now optionally include a latest or snapshot URL segment.
#13222 Adds support for Ubuntu 24.04 (Noble).
#8076 Adds the OS Type field to the R package Overview page in the UI for packages that specify an OS type.
Updated to Go 1.22.6.

Fixed

#13633 Fixed an issue where the PyPI repository view would incorrectly show some popular packages. The view will also now sort popular packages using 30 day rollups instead of 90 days.
#13545 Fixed an issue where Python signature files were being recorded as package downloads.
#13699 Retry Git clones when building Git packages in the case of transient download issues.
#13721 Fixed an issue that was causing reloads of the Bioconductor activity page to navigate to the error page.
#13656, #13724, #13750 Fixed several issues with missing messages when running the rspm update command.
#13621 Fixed an issue where changes to PyPI packages in an offline environment would not be reflected in PyPI repositories when installing packages from historical date snapshots.
#13692 Fixed an API issue with unbounded memory usage when enumerating packages.
#13692 Fixed an API memory issue to remove a potential Denial-of-Service (DoS) vulnerability.
#13728 Fixed an issue where multiple Git builds with matching checksums would sometimes fail.
#13557 Python and R repositories with no snapshots will no longer try and display a calendar.
#13852 Fixed a bug with the rspm_license_days_left metric returning the days left for a trial instead of the activated license.
#13880 Fixed an issue where Git builds would intermittently fail due to missing remote references.
#13886 Fixed an issue with retrieving data from empty Curated CRAN sources.
#14009 Adds back the Needs Compilation and Dependency columns to the rspm update for curated CRAN sources.
#14039 Fixed an issue where Postgres returned an unexpected EOF resulting in a fatal shutdown.
#13739 Fixed an issue with displaying all results for certain searches.
#14069 Fixed a Git builder issue that would cause the error sql: Scan error on column index 10, name "url": converting NULL to string is unsupported.
#14099 Fixed an issue with loading R package binaries for archived packages.
#14118 Fixed an issue where the distribution selectors displayed in the UI had different values.
#7179 Fixed an issue with loading R package binaries for archived packages from CRAN Snapshot sources.
#14121 Fixed an issue with the UI where archived source file URLs were invalid for packages with paths such as 4.5.0/Recommended.

2024.04.4

June 26, 2024

Fixed

#13938 Fixed an issue with migrating Curated CRAN sources when using a PostgreSQL database.

2024.04.2

June 14, 2024

New

#13648 Adds an index to the cache_objects table for more efficient cache evictions.

Fixed

#13747 Fixed an issue with migrating Curated CRAN sources that were created prior to Package Manager 1.2.0.

2024.04.0

May 6, 2024

Breaking

Air-gapped customers are required to redownload the CRAN data after upgrading before syncing the CRAN source. See the Admin Guide for more information.
The offline downloader version must now correspond with the Package Manager version.
#12664 Removes support for populating the database with information on cached objects when upgrading from versions prior to 1.1.2. If you are upgrading from a version prior to 1.1.2, recently used cached objects may be evicted, but will be automatically recreated on demand.
Removes support for the id query parameter from all API endpoints. Packages should be referenced only by name.
The /packages/:id/files/:path API address has changed to /repos/:id/packages/:name/files/:path and requires a package name instead of an ID.
The /packages/:id/readme API address has changed to /repos/:id/packages/:name/readme and requires a package name instead of an ID.
#12880 When updating a Git builder’s URL, specifying the branch is also required to ensure its existence.
#13182 Integrations with Artifactory must add the new **/rsf/** inclusion/exclusion rules to the repositories.
#13750 Updating the snapshot date of an empty curated CRAN source is no longer possible.

New

PyPI repositories can now be used in air-gapped or offline environments. Rather than downloading all of PyPI, you’ll define your own subset of packages you want to make available offline. See the Air-Gapped Package Manager documentation for instructions on how to set up an offline PyPI repository.
#13114 Adds automatic CRAN synchronization. Package Manager will synchronize the CRAN source on demand and check for CRAN updates every 10 minutes.
#13114 Major updates to the CRAN source. CRAN data is no longer stored in the database, which significantly reduces sync time and increases performance. If you are already using a CRAN source, you can take advantage of these improvements by running rspm sync --type=cran immediately after upgrading.
#12884 By default, new created Curated CRAN sources now use a more permissive package version snapshot behavior. You can still create Curated CRAN sources using the previous behavior by using the --strict option when creating the source. See the Admin Guide for more details.
#12884 rspm update now supports specifying a requirements.txt file with the --file-in flag for Curated CRAN sources.
#12884 New Curated CRAN sources can now filter individual packages using version constraints. This does not apply to Curated CRAN sources created before this release.
#12884 New Curated CRAN sources can now have their snapshots updated backwards in time. This does not apply to Curated CRAN sources created before this release.
rspm create source now supports a --include flag which determines which types of related packages are included in the source.
#12991, #13260, #13307 Python autodetection will now attempt to pick the highest available version of python or python3 bin in $PATH or /opt/python/* that has build and virtualenv modules. If no such version is found, it defaults to the highest version available.
#4639 R PACKAGES and PACKAGES.rds responses for package binary lists include new fields.
- #4639 For local and Git package binaries, the new Sha256Hash field records the SHA256 hash for the file.
- #4639 For CRAN package binaries, the new Hash field can be used to determine when a package binary is updated. This field should not be used to verify file integrity.
#12534 Package Manager will now switch its built-in encryption to use the AES-256-GCM algorithm when the Server.UseFIPSEncryption setting is enabled. This algorithm is an Approved Security Function under Federal Information Processing Standard 140, which is applicable to many organizations.
#11873 The URL used for a Git builder is now displayed in the UI for associated Git packages.
#12624 Adds new blocklist flag --deleted-packages to block packages that have been removed from PyPI or CRAN from older snapshots.
#13037 Adds new rspm_license_days_left Prometheus metric for more convenient alerting.
#13366 rspm completions for the fish shell can be generated with rspm completion.
#13297 rspm update will now default to the latest snapshot if the --commit flag is absent for curated PyPI sources.
Updated to Golang 1.22.2.
#9509 Package Manager’s version will be included in the User-Agent header when syncing packages.

Fixed

#12560 Disables the calendar selector when an R repository is only subscribed to a Bioconductor source.
#12022 Improved error message when using the rspm add command with invalid flags.
#12559 Properly display binary files in UI for repositories that mix CRAN and Bioconductor sources.
#12626 Delete Python Git builders when a Git Python source is deleted.
#12448 The Server API Guide “Try it out” URLs now respect the path of the public server URL configured in Server.Address. The Server API Guide URLs can still be customized separately using the Swagger.Host and Swagger.BasePath settings.
#12448 The Swagger.BasePath setting no longer needs to end with /__api__. This may be removed from any existing Swagger.BasePath settings.
#12708 The Database.Provider configuration option is now case insensitive.
#11836 Python packages will no longer hyperlink malformed extra package links.
#9422 Orphaned Python packages are now deleted when running rspm evict --type packages.
#12730 Fixed a bug where the usage stats page would no longer render charts after changing the chart options.
#12804, #12687 Archived packages for combined repos are properly filtered based on subscription order.
#12936 Fixed the incorrect repository URL for Bioconductor repositories on the Setup page.
#9209, #12938 Fixed an issue preventing Linux binary packages in local and Git sources from being served for old, deprecated R versions.
#11633 Fixed an issue preventing Linux binary packages in local and Git sources from being served for the arm64 architecture.
#13206 Increased the systemd StartLimitBurst from 3 to 30 for more reliable recovery.
#13331 Fixed an issue that was causing temporary files to accumulate when downloads failed.
#13475 Fixed the output of the rspm list git-builds command to return valid JSON when the --output-format=json flag is provided.
#13383 Only attempt Git credential decryption once to avoid spurious logs about potentially sensitive values in plain text.
#13407 Double the default timeout for the rspm cluster [online/offline] commands.
#13415 Fixed an issue where the rspm [online/offline] and rspm cluster [online/offline] commands will intermittently timeout.
#6980 Fixed an issue where some packages could not have their checksum computed which caused some packages to be missing.
#12874 Logging has been improved when a secret decryption fails.
#12543 The UI no longer shows statistics on the home page unless a relevant repository exists.
#12777 List items in the Package Details UI are now more easily clickable.
#12545 Server logs are improved when Python cannot be autodetected.
#12540 The stats page now saves the selected ecosystem.
#12558 Warnings are now shown when curated repositories exist without the proper license.
#12528 The run-diagnostics script now excludes large binary files from the report.
#13209 The error page now presents a generic error message instead of internal errors.
#12729 Fixed a migrate database bug when migrating with stale data in job_launcher_jobs and git_package_builds; these tables will now be ignored.
#12587 Underlines package links on the activity page for R and Bioconductor repositories following accessibility best practices.
#13171 Repositories with empty Curated CRAN and PyPI sources no longer show an error.
#13150 The rspm create source now displays a better error when an invalid type is provided.
#13190 CRAN snapshots in error messages are formatted correctly.
#13341 Some archived CRAN packages were missing the occurred field.
#13405 Some documentation redirects were misconfigured.
#13166 Fixed a deadlock that can occur during syncs.

2023.12.0

December 18, 2023

Breaking

#9762 Ubuntu 18.04 (Bionic) has reached vendor end of support and is no longer supported.
#11867 Removes support for extracting README files for local and Git packages created in Package Manager versions prior to 1.0.6. If you are upgrading from a version prior to 1.0.6, this means that existing packages in local and Git sources will be migrated correctly, but Package Manager won’t automatically extract README data for the migrated packages. You can work around this limitation by upgrading to version 2023.08.0 prior to this version.

New

#11932 Adds package vulnerability reporting based on osv.dev advisories. Known security vulnerabilities will be displayed on the Package page for CRAN, Bioconductor, and PyPI packages.
#11931 Adds --vulns option to rspm create blocklist-rule to block packages with known security vulnerabilities.
#9749 Database migrations are now stricter when comparing data. Migration errors now display the table and column where mismatch occurred.
#11952 Adds support for creating Git builders with Python packages using rspm create git-builder command.
#11935 Adds banner for blocked packages, archived versions, and distributions. If a description exists for the blocking rule, it will be displayed on the banner.
#11967, #11971 Grayed out various broken URLs for downloading package binaries, distributions, etc. if they are known to be blocked.
#11964 Adds rspm create bulk-blocklist-rules (alias rspm create bulk-bl) command to bulk add blocklist rules via file or STDIN.
#6544 The pre-install script now creates a symlink from the rspm command to the /user/local/bin directory and, if available, initializes bash autocompletion.
#10071 The rspm delete blocklist-rule command now supports bulk deletion of either all or a subset of rules with specified --id flag.
#11881 The R Package page now displays the sub-path of the package within the repository if present, such as Path: Older or Path: 4.4.0/Recommended.
#4594 Render Python reStructuredText READMEs in the UI.
#8490 Adds the Git.AttemptVignettes option to attempt building R Package Vignettes through the Git Builders.
#11923 Adds the source type and SPDX license types for package requests to the service log using the src_type and lic_type fields.
#12051 Adds new endpoints to gather vulnerability information on sources, repositories, and packages.
#12079 Adds EnvironmentFile support to systemd service definitions.
#11801 When the Server.RVersion option is unset, attempt to autodetect R by checking the PATH and some well-known installation directories.
#12078 Adds support for uploading Python packages to local-python sources with the rspm add CLI command.
#12101 Adds ability to pass in a directory for the --path flag when uploading packages with rspm add, supported for both local and local-python sources.
#11935 Adds [CRAN, PyPI, Bioconductor].DelaySyncDuration config option to have the ability to delay sync by a certain number of [hours|days].
#12104 When the Server.PythonVersion option is unset, attempt to autodetect Python by checking the PATH.
#12271 The webpage footer now displays the product tier.
#12273 Adds support for increasing Git cloning depth when adding/editing Git builders with a new --clone-depth=[depth] flag.
#10858 Adds support for openSUSE 15.5 and SLES 15 SP5.
#12249 Adds support for new license tiers (Basic, Enhanced, and Advanced).

Fixed

Accessibility improvements in the UI.
- #11739 Fixed keyboard navigation of radio button groups on the Setup page.
- #11794, #11805, #11824 Fixed missing accessible labels and markup for disclosure buttons on the Packages page, Activity page, and navigation bar.
- #11821, #11795 Fixed missing accessible labels on search inputs and their clear buttons for packages and usage stats.
- #11793 Removed duplicate empty link in the navigation bar.
- #10738 Copy buttons are now better labeled with unique descriptions.
#11898 Navigating between Python packages had a noticable delay.
#12280 Minor performance improvements to R and Python package serving when packages have been blocked.
#12296 Sandboxed Git builders now share the same network configuration as the host so they can pull external dependencies.
#12323 Fixed the empty git-upload-pack given error that ocurred with Git builders for Azure Git repositories.
#12379 Increased the default package cache size.
#12532 Fixed an issue with incorrect “Content-Length” header reporting when using S3 with client-side KMS encryption.
#11784 Respect proxy environment variables (http_proxy/https_proxy) with remote CLI usage.

2023.08.4

October 30, 2023

Fixed

#12138 Fixed an issue where git-builders could not be created when the scheme (e.g. ssh://) was prepended to the URL.
#12135 Fixed an issue that could prevent Git builds from working unless sandboxing was disabled via the Git.AllowUnsandboxedGitBuilds = true setting. This most commonly occurred when using a Linux Security Module such as SELinux.

2023.08.2

October 19, 2023

Fixed

#11870 Package Manager now attempts every PACKAGEMANAGER_DISTRO when autodetection of the OS fails.

2023.08.0

September 12, 2023

Breaking

#10439 For custom binaries, some distribution aliases such as rhel7 have been deprecated, use supported distros from rspm list distributions instead, such as centos7.
The rspm create token command now forces the use of the --scope flag. If left blank, it will no longer default to --scope=sources:write.
openSUSE 15.3 and SLES 15 SP3 have reached vendor end of support and are no longer supported.
#10955 Git builders no longer require the Job Launcher. Any Git builds in the job queue at upgrade time will be canceled, but will be rescheduled at the next Git builder poll.
#10955 The [Launcher] configuration section has been deprecated since Git builders no longer require the Job Launcher. Please remove any existing [Launcher] sections from your configuration files.
#10955 Logs for previous Git builds will be inaccessible after upgrading. Use the rspm logs command prior to upgrading to retrieve any Git logs that must be preserved.
#10982 When Git.AllowFileURLs = true and any Git builders use file:// URLs, Git must be installed on the server.
#11095 The default storage alerting threshold has been changed from 75% to 90%. To restore the original setting, add StorageAlerts.Threshold = 75% to your configuration file.
Installers are signed with a new Posit GnuPG key. See the Posit Signed Builds page for more information about signed builds.
#11356 The default permission for the user.conf systemd configuration file has been changed from 0600 to 0644 to prevent warnings about world-inaccessibility.
#11510 Disabled binary distributions no longer appear in the UI as a selectable distribution.
#11631 The PACKAGEMANAGER_ENCRYPTION_KEY environment variable will now take precedence over a key file at the [Server].EncryptionKeyPath location instead of failing to start.

New

#10376 Adds automatic PyPI synchronization. Package Manager will synchronize the PyPI source on demand and check for PyPI updates every 10 minutes.
#9883 Enables remote token authentication for rspm create git-builder
#10544 CRAN and PyPI repositories now support nearest-snapshot matching when used with date-based URLs. See Snapshot Identifiers in the Admin Guide for details.
#10557 Adds new block list token scope --scope=blocklist:read for rspm create token command. See also breaking changes.
#10557 Enables remote use for all blocklist CLI commands, e.g. rspm list blocklist and rspm test blocklist
#10939 Adds the ability to rerun a Git builder job for a specific Git SHA.
#8799 Supports Git builders with custom names by adding an optional --name flag.
#7111 Adds support for Git submodule recursion when adding/editing Git builders with a new --recurse-submodules=[depth] flag.
#5603 Adds a Git.AllowTagVersionMismatch setting to allow Git builds when the Git tag version does not match the DESCRIPTION file version.
#11010 Adds support for serving precompiled binary packages for Debian 11 (Bullseye) and Debian 12 (Bookworm).
#10588 Adds Server.CustomHomeTitle config option to have the ability to customize the Home Page UI text.
Adds support for macOS R package binaries for both x86 and Apple Silicon (arm64) CPU architectures. These are available for R versions 4.1, 4.2, and 4.3 on CRAN or user-uploaded.
#10504, #11132, #10502 The Homepage page has been redesigned to be more functional.
#10503, #10589 The Setup page in the UI has been redesigned to be easier to navigate.
Many accessibility improvements have been made to the UI.
- Tab navigation is now fully supported.
- Keyboard focus has been improved.
- Semantic HTML tags such as header, link, and button elements are now better used.
- Usage graphs now contain a textual representation that is accessible to screen readers.
- Color contrast has been improved.
- Links are underlined.
- Page titles update on navigation.
- Images, aside from those in package READMEs, now contain alt text.
- Form fields now have attributes set for screen readers.
- Modal dialogs no longer lose keyboard focus.
- maximum-scale is no longer set.
#10505, #10594 Most UI pages now fill the width of the browser.
The UI will retry failed requests.
The UI will cache and update API responses.
The UI better displays when a Readme is available for a package.
#10604 The What’s New page hierarchy is easier to navigate.
The UI URLs now contain more information about what screen the user is on.
- #10723 The repo routes now use the repository name instead of ID.
- #11217 The source on the Activity page route is now the name instead of the ID.
- The packages routes now include more information about the package ID and whether a user is on the Overview or Readme pages. (#10600)
- #10722 The Setup page URLs now contain query parameters that make it easier to share links.
- #11517, #11288 URLs from previous versions of Package Manager will properly reroute to the new URLs.

Fixed

#8433 Fixed an issue that caused Windows binary package serving and binary availability reporting to fail when using third-party integrations such as Artifactory. When third-party integrations do not support proxying ETag response headers, Package Manager now falls back appropriately.
#10471 Fixed a bug where some archived R package requests served the package source when a binary was available.
#10479 Fixed an issue where deleting Git builders while Git builds were still running could result in an incomplete cleanup of files in the Git.BuilderDir directory.
#10484 Fixed an issue where deleting SSH keys for Git building while Git builds were still running could result in an incomplete cleanup of SSH agents.
#10518 Fixed an incorrect error message in the server log when starting the server with invalid HTTPS credentials for Git building.
#10512 Fixed an incorrect error message in the server log when deleting HTTPS credentials for Git building.
#10926 Fixed an issue sanitizing weak etags from integrations which would lead to error logs like _W/"..: no such file or directory.
#11075 Fixed a bug with the Binaries.Distributions setting where binary packages could still be served for disabled distributions.
#11511 Fixed an issue with unbounded accumulation of cached PyPI manifest data. Older PyPI manifest data is now evicted at the normal eviction interval.
#11512 Fixed a bug where arm64 Linux users were receiving x86-built R package binaries.
#11631 Fixed a bug where the PACKAGEMANAGER_ENCRYPTION_KEY environment variable was not honored for Git builders.
#11631 When the PACKAGEMANAGER_ENCRYPTION_KEY environment variable is set, an encryption key file is no longer generated at the [Server].EncryptionKeyPath location.

Deprecated/Removed

#10557 The rspm create token --blocklist flag is deprecated in favor of --scope=blocklist:admin and --scope=blocklist:read.
#10725 The Lock Package Data checkbox has been removed from the Setup page. Snapshots will continue to be backwards compatible and deterministic.

2023.04.0

April 28, 2023

This release of Package Manager introduces the ability to globally block packages for an entire instance, preventing downloads of packages with known vulnerabilities or prohibited license types. Additionally, Package Manager now supports creating curated subsets of PyPI with a curated-pypi source, allowing only the Python packages from PyPI you permit. This release also heavily optimizes the PyPI source, making synchronization happen instantly.

Breaking

Upgrades from versions before 2023.04 may take longer than usual to start the first time due to a metrics data migration.
#10197 Adds a new Persistent storage class for storing PyPI and Curated-PyPI data. If you have a [Storage] configuration section that references specific storage classes, you will need to add a value for the Persistent class. We highly recommend switching to the Storage.Default setting to avoid issues when new storage classes are added. See the Admin Guide for details.
#9363 A fatal error will now occur when using an SQLite database on an NFS volume. Can disable this functionality by using the new Sqlite.NoNFSCheck = true option.
#6964 Package Manager instances configured to use S3 for storage will now automatically store package files. Use the RetainFetchedPackages option to change this behavior.
#9415 The individual [CRAN, PyPI, Bioconductor].RetainFetchedPackages settings have been deprecated in favor of a single Server.RetainFetchedPackages option.
#9707 Python repos now prohibit using the id query parameter with the /repos/:id/packages/:key API endpoint.
#9707 The rspm clear CLI command no longer supports the --type=pypi flag.
#9962 The admin guide “Security and Auditing” page has moved to a security folder called “Server Security and Auditing,” redirects have been added.
#9862 The admin guide “PyPI Mirroring and Local Python Packages” page has moved to a Python folder called “Python Packaging,” redirects have been added.

New

#9962 Adds the ability to globally block packages across all snapshots and repos to prevent unwanted downloads. See the Package Blocking guide for more information.
#9863 Adds the ability to create curated subsets of PyPI with the new curated-pypi source. See the Quick Start guide for more information.
#9707 Major updates to the PyPI source. PyPI data is no longer stored in the database, which significantly reduces sync time and increases performance. If you are already using a PyPI source, you can take advantage of these improvements by running rspm sync --type=pypi immediately after upgrading.
#9332 The API documentation examples will now autodetect the transfer protocol scheme and hostname.
#7848 The UI now displays an alert banner when the license is close to expiration. The default threshold is 30 days, and it is configurable using the Licensing.ExpiryDaysReminder option. Can disable completely by using the new Licensing.DisableExpiryBanner = true option.
#9617 Export application runtime metrics through the prometheus endpoint for better observability. Set the Metrics.Enabled = true option to enable.
#9667 Adds new /[Repository]/[Snapshot]/web/packages/[Package Name]/DESCRIPTION endpoint to support calls from remotes::install_dev for R repositories.
#9648 The error message when trying to create, add, or update a Curated CRAN source for a snapshot that doesn’t exist now outputs nearby snapshot dates.
#9858 The Usage Stats page now counts multiple license specifications as individual licenses (e.g., GPL-2 | GPL-3 as GPL-2 and GPL-3).
#10028 Frozen URLs for Python repos no longer include the “Lock Package Data” checkbox.
#6274 The output for the rspm list CLI commands now includes the pinned snapshots for curated-CRAN and CRAN-snapshot sources.
#9955 The command rspm list sources can now be filtered by specific types of sources with a new --type flag.
#9955 The command rspm list repos can now be filtered by specific sources with a new --source flag.
#10212 The command rspm update now supports outputting JSON with --output-format=json.
#9316 The documentation navigation bar has been updated to include the user guide, licenses, and release notes.

Fixed

#9221 The Server API documentation now correctly lists all available values for the bioc_version query parameter.
#9406 Git builds no longer fail with an expired certificate error when Package Manager has been running for longer than a year.
#7019 Improved error messages when building Git packages with an invalid subdirectory.
#9510 Fixed an unhandled error that could result in incomplete cleanup after failed syncs or other transactional operations.
#9792, #9793 Fixed an issue where license info for some Python packages would be missing in the UI.
#8682 Fixes an issue where some Python packages would display the full license instead of the license type on the Usage Stats page.
#9910 Fixed an issue with displaying very long package names on the Usage Stats page.
#9580 Addressed an open redirect vulnerability where Package Manager may redirect users to an untrusted external website based on a user-provided path in the URL.
#10200 Fixed a bug where the migrate utility was creating an empty SQLite database when SQLite.Dir was unset, this now raises a no such file error. To resolve this, set an absolute path to the database in the SQLite.Dir setting.
#9645 Fixed a bug in the logs documentation referring to Debug.Log = route instead of the correct Debug.Log = router.
#9719 Fixed a bug that caused Package Manager to serve the source package when a Windows package binary was not found, instead of correctly returning a 404 error.
#9960 Fixes an issue on the Usage Stats page where search queries containing certain special characters would not work.
#9932 Fixed a bug in 2022.11 that incorrectly recorded usage stats by license type.
#10343 Fixed a bug where Python version releases were sometimes not sorted properly.

Deprecated/Removed

#9971 Deprecates the PyPI.DownloadConcurrency configuration option. This option is no longer relevant to PyPI.
#9983 Removes the unused GET /repos/:id/first-transaction API endpoint.

2022.11.4

December 05, 2022

Fixed

#9407 Fixed an issue that prevented some local Python packages from being uploaded with Twine.
#9419 Fixed an issue that prevented some local Python packages from displaying correctly on the Package page.

2022.11.2

November 18, 2022

Fixed

#9345 Fixed an issue that prevented serving R package binaries for archived packages.

2022.11.0

November 14, 2022

This release of Package Manager introduces the ability to upload your own Python packages, using the existing Twine toolset to upload packages to local Python repositories. In addition, Package Manager has been rebranded to reflect the new Posit branding.

Breaking

#8399 Removes the top-level rspm import command, use rspm import ssh-key or rspm import https-credential instead.
#8778 Migrates PyPI data into more appropriately named tables. This may slightly delay the first server startup time after the upgrade.
#8586 The rspm add --replace flag no longer replaces packages stored with identical checksums.

New

Adds the ability to upload local Python packages to a new local-python source. See the Quick Start guide for how to use this functionality.
#7851 Set environment variable GIT_CEILING_DIRECTORIES to the Git builder directory during a Git build to protect against CVE-2022-24765 for customers who can’t upgrade Git immediately.
#8509 Updates the Packages page in the UI to display the list of packages in a scrollable area.
#8399 Adds new rspm edit [ssh-key|https-credential] commands to update Git builder credentials in place.
Updates to Golang 1.19.
#8935 Updates Launcher plugin to version 2.8.0 using Golang 1.19.
#8387 Adds new --succeed-on-existing flag to the rspm [add|create|import|subscribe] commands for automation tools running the same commands each time.
#7939 Omits debug symbols from the application binary, see the Go link command documentation for more information.
#7282 Omits debug symbols from R binary packages for Linux, R 3.6 and above, significantly reducing the size of packages with compiled code.
#8744 Adds an internal shortener to the fix URL lengths generated through the calendar date picker to 8 characters.
#9117 Adds a new --hide option to the rspm edit repo command to hide repositories from the user interface.
#8127 Adds support for Red Hat Enterprise Linux 9.
#7933 Adds support for openSUSE 15.4 and SLES 15 SP4.
Updates UI to NodeJS 1.18.
Updates admin documentation dependencies.
#8876 Improves activity page UI.
#9044 Scroll long licenses in UI usage page.
#8732 Rebrands application for RStudio’s change to Posit.
#9133 Introduces a new User Guide focusing on use of Package Manager for the data scientist, based on the previous User Interface Overview page.
#8152 Now soon-to-expire API tokens output a warning in the log.
#8675 Python Package UI now displays the project homepage URL.

Fixed

#8526 Fixed a bug where the sync command would ignore the Manifest.User and Manifest.Password settings.
#8767 Fixed an issue that could prevent scheduled tasks from working in a cluster environment and cause the following error: Error verifying cluster integrity: node list length differs. This affected certain PostgreSQL configurations, such as PostgreSQL clusters deployed using Amazon Aurora Serverless v1.
#7914 Fixed an issue that could cause Windows binary package installations to temporarily fail for newly released versions of R.
#8571 Fixed an issue that could cause incorrect reporting of binary availability for local and Git sources.
#8608 Fixed an issue that could cause incorrect reporting of binary availability for CRAN packages with R patch version dependencies (e.g., R (>= 3.5.1)).
#9197 Fixed an issue with the reporting of binary availability for R versions and distributions that have reached end of support.
#8916 Improved error messages when adding an existing package using the rspm add command.
#8913 Fixed an issue that could cause a panic when switching from offline to online mode with Prometheus metrics enabled.
#6396 Fixed an issue that left behind date aliases when using the rspm clear command.
#8088 The Server API endpoints to query available binary packages now support R versions that have reached end of support.
#9056 Removed a duplicate header appearing on the licenses page.
#9113 Fixed an issue where certain Windows binaries couldn’t be added to a local source.
#8319 Fixed rendering of the Debug section on the configuration guide.
#9148 Fixed the example URLs for Python repos when using rspm url create.
#9019 Fixed an issue where some UPSI URLs would include sources that were not subscribed to the repo anymore.
#8485 Fixed issue when PACKAGEMANAGER_ADDRESS environment variable had a trailing slash.
#8607 Correctly parse R versions with certain formats.

2022.07.2

August 2, 2022

Fixed

#8428 Fixed a bug that caused incorrect download counts for a package when some versions of the package were deleted.

2022.07.0

July 19, 2022

This release of Package Manager introduces the ability to add your binary package builds for R packages. To help publish these binary packages, we’ve also included a new remote publishing feature that makes it as easy as ever to integrate with your build processes and CI/CD pipelines. Finally, we’ve taken the PyPI mirror source out of beta, and it’s ready for production.

Breaking

Any Python repositories previously subscribed to the PyPI source need to be resubscribed and resynchronized. For more information, see the PyPI quickstart guide.
#7807 Removes installation dependency for the curl and rrdtool software packages, which were not required or used.
#8216 Removes recommended dependency on the r-base software package for DEB packages. To install R for building Git packages, we recommend installing R from the precompiled binaries at Install R.
#7883 SLES 12 SP5 has reached vendor end of support is no longer supported.
#7920 The recommended system requirements and installation instructions documentation pages have been migrated to the https://docs.posit.co/rpm/documentation/ site.

New

PyPI support is ready for production use. The time required to sync information has been greatly reduced.
Adds support for supplementing local and git sources with precompiled binary packages. See Adding Local and Git Binaries for more information.
Adds support for API token authentication for remote CLI use. See API Tokens for details about enabling and using API tokens.
You can now download the rspm CLI separately as a standalone application for Linux, Windows, or macOS.
rspm add and rspm add binary now support remote use with API tokens. See Admin CLI Remote Use for more information.
#7872 rspm add for local sources now supports installing multiple packages at the same time in a single snapshot. rspm add --path supports passing in multiple file paths that are comma-seperated. rspm add --file-in also supports passing in a CSV that contains all package paths. For examples on how to use this, see the Getting Started documentation for local packages.
#8074 The encryption key can now be specified in the PACKAGEMANAGER_ENCRYPTION_KEY environment variable instead of using the key file directly. This is intended to make it easier to inject the encryption key into containers.
#7349 Adds support for Ubuntu 22.04 (Jammy).
#7818 Adds support for serving precompiled binary packages for R 4.2.
#8132 Adds the Content-Disposition header to package download responses.
#7926 The web UI now loads JavaScript dependencies through ESM modules. This will break compatibiltiy with browsers that don’t support ESM modules

Fixed

#7764 The Activity Log UI will now display when a package is deleted from a Git source.
#7799 Fixed a race condition when running rspm add after creating a repository that would sometimes log the error message Error: Unable to locate package(s).
#7598 Fixed a bug that caused git-builders to lock up Package Manager until all builders were completed.
#6984 rspm create git-builder will now use the default branch of a repository if the --branch flag is not provided.
#8037 Fixed an issue where Git builds could fail if a commit was pushed to the remote Git repository before the build had completed.
#8037 Improved performance of Git building for Git repositories with a large number of tags.
#7624 Fixed an issue that could cause all Git builds to fail when running RSPM as root. This was a file permissions issue that prevented the Job Launcher from starting correctly. The data directory (/var/lib/rstudio-pm by default) is now given file permissions of 0701 instead of 0700.
#7806 Added missing installation dependency for the libssl1.1 software package for DEB packages.
#8222 Increases the number of attempts to download sync information to fix the error CheckpointDownloadRunner returned error: GET "...": unexpected HTTP status 500.
#7925 Fixed an issue that prevented Job Launcher debug logs from being created. When enabled, Launcher debug logs are now written to Server.LauncherDir once again.
#6454 The rspm-offline-downloader tool now supports downloading binary packages for newly released R versions and operating systems (including R 4.2 and Ubuntu 22.04) without requiring an upgrade of the tool. Note that future release notes for the RSPM Offline Downloader will located in the new Offline Downloader News page.
#5271 The general performance of the rspm-offline-downloader get cran command has been improved.

Deprecated/Removed

#8158 Deprecates the CRAN.Binaries configuration options in favor of the new Binaries.Distributions option. Users with a customized CRAN.Binaries setting should configure the new Binaries.Distributions option.

2022.04.0

April 12, 2022

This release of RStudio Package Manager provides new insight into which packages have pre-built binaries available for your desired R version and distribution. It also contains various improvements to Git building and many other bug fixes.

Breaking

Deprecates the CRAN.ManifestURL, Bioconductor.ManifestURL and PyPI.ManifestURL configuration options. Note that users should configure the new Manifest.URL option.
Removes the outdated info-cran command from the offline downloader.
Deprecates calling the rspm import command without either the ssh-key or https-credential subcommand.
Deprecates the --ssh-key argument to the rspm create git-builder command in favor of the --credential flag.
Deprecates the rspm delete ssh-key subcommand in favor of the more general rspm delete git-credential.
Deprecates the --new-ssh-key argument to the rspm edit git-builder in favor of the --new-credential argument.
Deprecates the rspm list ssh-keys command in favor of rspm list git-credentials.
Refactor the files and directories storage documentation into multiple pages.
Removes the Source and Binary buttons on the Setup page for CRAN and Bioconductor. This simplifies how binary and source packages are displayed and served to the user.
Changed field name from Name to Package in rspm add --csv-out CSV output file to be compatible with the standard package database format in R.
CentOS Linux 8 has reached vendor end of support and is no longer supported. RHEL 8 remains supported, and continues to use centos8 in its binary package repository URLs for backward compatibility.
openSUSE 15.2 and SLES 15 SP2 have reached vendor end of support and are no longer supported.

New

The UI now displays whether a binary file is available for a CRAN package, and provides a link to download the binary package if available. On the package page, scroll down to the new “Binary File” section, and select a distribution and R version to check binary availability for that environment. To learn more about when binaries are available, see the Binary Availability documentation.
Adds two new Server API endpoints to query available binary packages, /repos/{id}/packages/{name}/binaries and /repos/{id}/binaries.
The /status API now returns Package Manager’s list of supported R versions for binary packages.
Adds a new configuration stanza Manifest that can be used to change the outgoing URL, set a Basic authentication User, and set an encrypted Password field.
Adds support for HTTPS credentials for Git builders. HTTPS credentials can imported using the new rspm import https-credential command, used to create Git builders using the rspm create git-builder --credential=<name> command, and listed using the new rspm list git-credentials command. See Importing an HTTPS credential for more information, including how to import credentials securely.
- With the addition of HTTPS credentials, several commands have been changed to support both SSH keys and HTTPS credentials, including the addition of a new rspm import ssh-key subcommand to specifically import SSH keys. See the Breaking changes in this release for more information.
When importing an SSH key with a passphrase, the passphrase file may now contain encrypted text from the rspm encrypt command.
Adds --remove-credential argument to the rspm edit git-builder command, to dissociate a credential from a Git builder.
Adds a new Git.AllowFileURLs configuration option that can be used to create a Git builder based on a local Git repo.
Adds a new composite index to the metrics table to improve package view performance.
Adds a new S3Storage.KMSKeyID configuration option that can be used to enable client-side encryption before transferring files to S3. See the S3 storage documentation for caveats and additional information.
Adds the ability to configure Package Manager with environment variables. See the configuration documentation for additional information and examples.
Adds a new /robots.txt endpoint to help search engine crawlers know what URLs they can access.
System requirements and distribution updates will now use reloaded URL configurations. These previously required an application reboot to take effect.
CSV files output with rspm add --csv-out can now be imported into R and used with tools::package_dependencies() to analyze dependencies before adding packages to a curated CRAN source.
Rename the button Client OS to Distribution to allow for great flexibility in the future.
Group official RStudio-supported distributions in the distribution picker.

Fixed

Fixed a bug that was truncating commit and published timestamps from appearing for built Git packages. This fix will only work for published packages moving forward.
Fixed an issue where some packages README images were not rendering correctly.
Fixed an error with the /alerts API endpoint when storage auditing is disabled.
Updated rspm encrypt command to output only the result on stdout.
Fixed an issue where the locked status of a CRAN snapshot source was not accurately reflected in the frozen URL description.
Fixed an issue where the UI could display invalid archived versions for packages in CRAN snapshot sources.
System requirements and distribution updates will now use reloaded URL configurations. These previously required an application reboot to take effect.
Removed the need to create socket file when running migrate utility, which requires that RSPM not be running.
Fixed an issue with storage alerts for local file systems. This was preventing the service from starting properly.
Fixed an issue where cache eviction tasks could run more frequently than intended and cause RSPM to respond slower.
Package Manager no longer requires the --privileged flag to run in a Docker container. However, sandboxed Git builds still require system calls not permitted by Docker’s default seccomp profile, and mount operations not permitted by the default AppArmor profile. You will need to either (a) start the container with --security-opt 'seccomp=unconfined' and --security-opt 'apparmor=unconfined'; (b) provide alternative seccomp and AppArmor profiles; or (c) set Git.AllowUnsandboxedGitBuilds = true in your configuration to disable sandboxed builds entirely.
The RSPM installer for RHEL 8 is now correctly signed with the RStudio GnuPG key.
Fixes a bug that was causing some CLI commands to fail with a 5xx response. In the logs this appeared as ERROR: payload string too long (SQLSTATE 22023).

2021.12.0

December 23, 2021

Breaking

The calendar will now only display dates as selectable when an update or transaction occured for that repository. The rspm url create command can be used to generate a URL for any date and set of transactions.
The default minimum TLS version is now correctly configured as 1.1, instead of defaulting to 1.0. Note that this can be changed using the HTTPS.MinimumTLS configuration option.

New

Adds support for openSUSE 15.3 and SLES 15 SP3.
Adds a new configuration option Server.LegacyCalendarTransactionURL that can be used to revert single-source repositories to use a numeric identifier (e.g. /repo/4115) in the calendar URLs instead of the default hash values.
The calendar will now display the snapshot date as a valid date on the calendar instead of the transaction date for CRAN snapshot sources.
Introduced code splitting to improve webpage loading times.

Fixed

Performed security and dependency upgrades for libraries used by the server and web interface.
Improved the caching layer throughout the product. This should result in faster package downloads, page loads, and greater scalability due to lower database usage.
Fixed a timezone issue where the browser’s selected calendar date and the URL generated by the server could differ by one day.
Fixed an issue with leadership election that could result in two or more leaders being elected and the Error verifying cluster integrity: node list length differs log line.
Fixed an issue with leadership election that could result in the Error pushing leader assumption work to queue log line, failing requests, and/or the service taking a long time to restart.
Fixed an issue with leadership election and multiple interfaces on an instance resulting in the node "X" with IP "Y" from store not known by leader log line.
Fixed an issue serving R package binaries for new operating systems and R versions, such as openSUSE 15.3 and SLES 15 SP3, or R 4.2 and above.
Fixed an issue that prevented system requirements from being listed for new operating systems, such as openSUSE 15.3 and SLES 15 SP3.
Fixed an issue that could prevent R packages encoded in Latin-1 from being installed in R 3.5 or below.
Fixed an issue with static assets not caching correctly in the UI.
Fixed a bug that was incorrectly logging Warning: SQLite directory error message for some PostgreSQL installations.

2021.09.0

September 8, 2021

This release of RStudio Package Manager contains a new calendar view and improved way to freeze your set of packages. It also contains logging improvements and many important bug fixes.

Breaking

The default logging location has been moved from /var/log/rstudio-pm.log to /var/log/rstudio/rstudio-pm/rstudio-pm.log. This will also impact the access logs.
The following operating systems have reached vendor end of support and are no longer supported:
- Ubuntu 16.04 (Xenial Xerus)
- openSUSE 42.3
- openSUSE 15.1
- SLES 15 SP1
Dates returned to the Usage Stats page are now ISO 8601 dates rather than a full RFC3339 timestamp.
The minimum number of PostgresPool.MaxOpenConnections will now be set to 10.
Air-gapped customers using Bioconductor with RSPM 1.2.0 or 1.2.2 are required to fetch the new v4/1 schema after upgrading RSPM to 2021.09.0, but before syncing the Bioconductor source. Please refer to the admin guide for more details. The 1.2.2.1 release includes this step, and you need not repeat it if you already updated to that release.
The date aliases for the CRAN source will now use UTC as the basis for the date.
Both the Activity page and the Setup page will now use UTC for all dates and times.

New

Introduces a new, more flexible repository calendar. Users can now freeze to any date in the repository’s history, and frozen repository URLs now include the snapshot date in YYYY-MM-DD format. The calendar is now supported in many cases where it previously was not, particularly for repositories with multiple sources. Existing repository URLs that use a numeric identifier (e.g.,/repo/4155) are still supported, and will continue to work. More information about the calendar is available in the User Interface Overview section of the Admin Guide.
Adds a rspm url create command to create a frozen repository URL, and a rspm url explain command to explain what a frozen repository URL encodes.
RSPM can now serve binary packages for new R versions and operating systems without upgrading to a new version. The list of supported platforms is now synced from the RStudio Package Service.
Git-builders may now be edited using the rspm edit git-builder command to change the SSH key, Git URL, branch, and subdirectory.
Git-builders using “commits” triggers may now be configured to use the version in the DESCRIPTION file instead of the unique, timestamped version. See the new Git.ForceDescriptionVersion configuration option for more information.
Adds additional logging indicating when CRAN, Bioconductor, and PyPI packages are being checked for updates.
A PID file is now created to track the Package Manager process ID.
Adds two new sections to the documentation that describe available command-line options: Command-Line Interface and Offline Downloader.
Logs are now available through journalctl.
The UI and CLI will now provide better error messages to help customers get started with setting up repositories and sources.
The general performance of the rspm-offline-downloader get cran command has been improved. By default the concurrency value is set to 10 and the --concurrency flag accepts higher values for quicker downloads.
Adds a more helpful error message when attempting to unsubscribe a Bioconductor repo from a source. This action is not allowed because Bioconductor repos are automatically subscribed to sources.
Adds support for the Bioconductor books repository. The books repository will be available in Bioconductor sources after the next Bioconductor sync.
The PyPI source now supports YYYY-MM-DD date aliases for frozen repository URLs.
Adds a new rspm completion command to generate a CLI autocompletion script for Bash. More information is available in the Admin Guide.
Starting with this release, RSPM will now use a calendar-based versioning scheme.

Fixed

Fixes an issue where Bioconductor syncs could treat the order of sync actions incorrectly, leading to sources that fail to sync. This issue only affects users of Bioconductor repositories. If you are upgrading from RSPM 1.2.0 or 1.2.2, please use rspm sync --type=bioconductor to resync your Bioconductor sources. The 1.2.2.1 release includes this step, and you need not repeat it if you already updated to that release.
Fixes a bug that could schedule two or more interfering package updates for the same source.
Fixes a bug where some SSH keys with passphrases were not being imported correctly.
Fixes a bug that prevented packages from being added to curated CRAN sources with certain --snapshot flag values.
Fixes a bug that could prevent the election of a leader in HA clusters.
The PostgreSQL driver has been upgraded to recover more quickly from lost connections and TCP resets. This also fixes an issue where some Azure customers were seeing a read: connection reset by peer error.
Fixes a bug where HA clusters could not verify node integrity.
Fixes loss of state in leader election during a loss of Postgres connection.
All errors in PyPI sync are now retried so that more syncs are successful.
Fixes confusing error message when Server.TempDir is not writable.
The recommended CRAN snapshots for Bioconductor were too early and could cause Bioconductor package installations to fail. For Bioconductor repositories, we recommend configuring R to use the revised CRAN snapshots on the Setup page. For R repositories, we recommend adding an appropriate CRAN snapshot using the revised instructions in the Admin Guide.
Fixes the instructions for using Bioconductor packages in an offline environment with newer versions of BiocManager (1.30.12 and above). If you are unable to use BiocManager offline, refer to the revised instructions on the Bioconductor repository Setup page.
Fixes a XSS-vulnerability with the experimental API swagger docs. The swagger UI has been upgraded to the latest version 3.51.1 in the process.
Fixes a PyPI sync bug that was impacting PostgreSQL users with the search_path option.
Fixes a rare bug that could prevent the application from starting after upgrading from version 1.1.6.1-* or earlier.
Fixes an issue with serving PyPI packages with plus signs in their filename.

Deprecated/Removed

Deprecates the Git --branch option when used in conjunction with the --build-trigger=tags flag.
Discontinues support of openSUSE 15.1, SLES 15 SP1, and Ubuntu 16.04 (Xenial Xerus) R binary packages. RSPM will continue to serve existing binary packages for these operating systems in perpetuity, but no longer provide new binary packages after several months. Please refer to the Admin Guide for more information about the supported operating systems and R versions for binary packages.
Internet Explorer 11 is no longer supported. Please see our Platform Support page for a list of supported browsers.
Deprecates the --cache-dir flag from the rspm-offline-downloader get cran command as caching and fast updates will now be enabled by default.

1.2.2.1

May 13, 2021

Breaking

Air-gapped customers using Bioconductor with RSPM 1.2.0 or 1.2.2 are required to fetch the new v4/1 schema after upgrading RSPM to 1.2.2.1, but before syncing the Bioconductor source. Please refer to the admin guide for more details.

New

Adds support for serving precompiled binary packages for R 4.1.

Fixed

Fixed an issue where Bioconductor syncs could treat the order of sync actions incorrectly, leading to sources that fail to sync. This issue only affects users of Bioconductor repositories. After installing this release, please use rspm sync --type=bioconductor to resync your Bioconductor sources. Bioconductor updates for the previous RSPM versions (1.2.0, 1.2.2) will not be updated going forward.
Fixed an issue where Bioconductor syncs could fail when using PostgreSQL.

1.2.2

March 02, 2021

Breaking

RStudio Package Manager no longer supports Red Hat Enterprise Linux/CentOS Linux 6.x.
Any Python repositories previously subscribed to the PyPI source need to be resubscribed and resynchronized. For more information, see the PyPI quickstart guide.
Removes Git support from the rspm add command. Use the new rspm create git-builder command going forward.
Removes deprecated rspm clear-cran command. Use the new rspm clear --type=cran command going forward.
RSPM will now validate S3 storage configuration options on start up.

New

Package Manager now provides filesystem storage auditing and alerting. When storage exceeds user-configurable thresholds, the server will alert in the log as well as the UI. More information is available in the Admin Guide.
Operational metrics can now be exported via a Prometheus-compatible endpoint to empower your own monitoring and alerting systems. More information is available in the Admin Guide.
Python packages now display additional release information including download links, SHA256 values, and the yank status.
Python packages release are now paginated in the UI.
Use the new [Storage].Default option to configure all variable storage classes together, for example setting [Storage].Default = S3 will ensure all packages are written to your S3 bucket.
Configure the maximum time to wait when connecting to the database by using the [Database].ConnectionTimeout option.
Package Manager can now be installed on both openSUSE 15.2 and SLES 15 SP2 systems.
Precompiled R binary packages are now available for openSUSE 15.2 and SLES 15 SP2.
System requirements information can now be listed for openSUSE 15.2 and SLES 15 SP2.
Additional startup validation is performed when using PostgreSQL with a search path.
Clusters now automatically elect a leader node. The leader manages jobs like schedule syncing and cache eviction to avoid duplicated work.
Package Manager now uses asynchronous messaging instead of database locking to track active work (like syncing CRAN sources); this improves performance and helps eliminate database resource contention.

Fixed

Fixes an issue that could result in syncing snapshots more than once, resulting in corrupted data. In the unlikely event that your installation is affected by this bug, you will be unable to start RSPM, and you will see the following error in the log:
```
Error running services: Error: Unable to initialize a connection to the
database: UNIQUE constraint failed: checkpoints.source_id, checkpoints.guid, checkpoints.version
```

If your installation is affected, please contact support. You can reinstall the previous RSPM version and continue using RSPM until the issue is resolved.

Some malformed or incorrect database configurations prevented startup and did not crash, these will now timeout accordingly.
Improves robustness of PostgreSQL database connections by automatically reconnecting when connections are lost.
Git builders now respect the specified --ssh-key flag when cloning repositories.
Fixes a race condition when building large Git repositories that was causing intermittent failures.
Fixes an issue with adding Git packages that have blank lines in their DESCRIPTION file.
Duplicate Python packages are no longer presented in the UI.
Some Python packages and files were missing from RSPM.
Patches the UI dependency marked to remove a potential Denial-of-Service (DoS) vulnerability.
We’ve improved the PyPI source sync operation; syncing should complete much more quickly and reliably. See the breaking change below about resubscribing and resyncing Python repositories.

1.2.0

November 24, 2020

Bioconductor Support

Bioconductor is now supported through a series of changes. We recommend upwards of 1 TB additional disk storage, and admin CLI actions are required to enable Bioconductor. Learn more about how to serve Bioconductor packages in the admin guide.
Adds a new Bioconductor repository type. Bioconductor repositories can be created using the rspm create repo --type=bioconductor command.
Adds new source types representing Bioconductor releases and R repositories within a release. These sources can be added to Bioconductor or R repositories.
Adds a new --type flag to the sync command that distinguishes between syncing CRAN and Bioconductor metadata.
Adds rspm-offline-downloader support for Bioconductor data.
Adds support in the web interface for Bioconductor repositories, including a new Setup page for working with BiocManager and Bioconductor repositories.
Adds support in the CLI for listing Bioconductor repositories, sources, and packages. Adds a new rspm list bioconductor versions command to list available Bioconductor releases.
Adds support to the Server API for Bioconductor metadata and repository information.

PyPI (Beta)

PyPI mirroring is now supported in beta through a series of changes and additions. We recommend upwards of 1 TB additional disk storage, and admin CLI actions are required to enable PyPI. Learn more about how to serve PyPI packages in the admin guide.
Adds a new Python repository type. Python repositories can be created using the rspm create repo --type=python command.
Adds new --type flag to the sync command that distinguishes between syncing CRAN and PyPI metadata.
Adds a PyPI config section for setting PyPI related configuration attributes such as the PyPI sync schedule.
Adds a new pypi source that is enabled by default when using a Python repository.
Adds support for listing and searching for Python packages.
Adds support in the web interface for PyPI repositories including searching for and displaying package data.
Adds support for routing pip requests.
Adds support for tracking PyPI package downloads and corresponding display in the Usage section of the web interface.
Adds support to the Server API for PyPI metadata and repository information.
Adds a new rspm clear --type=pypi command to clear PyPI metadata, for removing PyPI as a source, or for resyncing a fresh copy.

Changes to Curated CRAN Sources

Curated-CRAN sources can now be created using a --snapshot flag to specify an initial snapshot date. For example --snapshot=2019-11-07. A new rspm list cran snapshots command shows the available snapshot dates.
Curated-CRAN source add and update operations now support passing a snapshot date via the --snapshot flag, e.g., --snapshot=2019-11-07. Passing the --transaction-id flag is deprecated but still supported. The --commit flag is now required for both.
A new source type, cran-snapshot is available for creating a source that contains ALL of CRAN but only for a specific date. Like Curated-CRAN sources, CRAN-Snapshot sources can be updated using the rspm update command.

Misc

Adds new storage classes for Bioconductor and PyPI. If you use a non-default storage location for packages (e.g., S3), please configure the correct storage location for Bioconductor and PyPI before upgrading.
BREAKING: Removes the rspm-offline-downloader get-cran command. Use rspm-offline-downloader get cran going forward.
Improves download resiliency of the rspm-offline-downloader tool through increasing the number of retries and adding a timeout using exponential back-off.
Adds new --starting-snapshot flag to the rspm-offline-downloader tool that can be used to download RSPM CRAN data starting at a particular snapshot. Note: This does not impact R package binary downloads.
Adds new validate-cran command to the rspm-offline-downloader to validate that the destination contains all relevant snapshots and directories for RSPM to work correctly.
Updates the rspm edit repo command to no longer require the --new-name flag when updating a repository’s description.
Fixes a bug where local and Git packages could have missing package dependencies.
Prevents source sync from occurring thirty minutes after the desired schedule.
NOTICE: When using Postgres, RStudio Package Manager now verifies that a minimum version of 9.5 is being used. A warning message will be logged if the version of Postgres being used is older. The 9.5 minimum version is also noted in the PostgreSQL section of the Database chapter of the Admin Guide.
Updates UI search to prioritize exact matches first, also restricts matching-search to three or more characters.
Deprecates the clear-cran command. Use the new clear --type=cran command going forward.
Fixes a bug that could result in job queue deadlock under load. This prevents issues that could cause the RSPM service to stop responding.
Adds a response header to help identify Package Manager in requests: X-Repository-Type: RSPM
The Activity page in the web interface now shows the snapshot dates for the cran source, not the dates the snapshots were synchronized. This makes the Activity page easier to navigate and consistent with the repository calendar.
A repository that only subscribes to the cran source can now be indexed by dates as well as transaction IDs. The date aliases are shown in the repository Setup page where applicable.
The Package page now displays older package versions in descending chronological order.

1.1.6.1

July 13, 2020

Fixes a bug where Git builders could be created in non-Git sources, causing the rspm list git-builders and rspm list git-builds commands to fail.

1.1.6

June 23, 2020

BREAKING: Removes the --dryrun CLI flag that was required when adding or updating packages to curated-CRAN sources. Attempting to use this flag will result in a command error.
BREAKING: Use the Apache Combined Log Format as the default access log format instead of the Apache Common Log Format. Switch back by setting Server.AccessLogFormat = "common".
BREAKING: The CLI now waits for commands to complete by default. The following CLI commands are affected: rspm sync, rspm create git-builder, rspm run git-builder, and rspm rerun git-builder. Use the new --no-wait flag to run these commands asynchronously without waiting. The --wait flag remains available for backwards compatibility.
Adds rspm offline and rspm online admin CLI commands to support taking services offline and bringing them back online safely.
Adds rspm cluster offline and rspm cluster online commands to the admin CLI to support taking multiple nodes in a cluster offline and bringing them back online.
Adds a rspm cluster nodes command to the admin CLI to support listing nodes in a cluster.
Adds a rspm config debug logger commmand to temporarily alter the debug log configuration without restarting the Package Manager server.
Updates the Admin Guide High Availability and Load Balancing chapter with a new guide for upgrading a cluster.
Adds a new experimental Server API documentation for commonly requested endpoints. For more information see the new documentation.
Adds support for Ubuntu 20.04 LTS.
Adds support for serving precompiled binary packages for Ubuntu 20.04 LTS.
Adds support for listing system requirements of packages on Ubuntu 20.04 LTS.
Adds new Proxy.User and Proxy.Password configuration options to securely configure outbound proxies.
Deprecates the rspm add command for Git packages. Use rspm create git-builder going forward.

1.1.4.1

May 20, 2020

Adds support for serving precompiled binary packages for R 4.0.

1.1.4

April 10, 2020

Adds a new storage class for CRAN. Upgrading will result in a migration of existing CRAN packages and README files to the new storage class. If you use a non-default storage location for packages (e.g., S3), please configure the correct storage location for CRAN before upgrading. All CRAN packages will be moved to the new CRAN storage location upon service startup. If your installation has downloaded many CRAN packages, this may take some time, and the service will be unavailable until the migration is complete.

If the storage class configured for CRAN is of a different type than the packages storage class, startup will fail. If you wish to migrate CRAN packages to a different storage type, enable the Migration.EnableMixedClassMigration = true configuration property.

Adds eviction for orphaned packages. Git and local packages that are stored but no longer referenced in any sources will be removed periodically.
Adds a new CLI command list git-builds that can be used to review Git builder runs and debug potential problems.
Adds better caching and improves performance by:
- Adding configurable settings for in-memory caching.
- Caching system requirements data for better performance.
- Enabling package request caching by default.
Updates the license-manager command to incorporate recent bug fixes.
Adds the package size for local and Git packages to the Web client.
Adds the Git SHA to the Web client when displaying package information for packages from Git sources.
Adds an example configuration file that includes all the available configuration settings and their defaults at /etc/rstudio-pm/rstudio-pm.gcfg.defaults.
Fixes a bug where adding Git packages via SSH could fail with certain SSH server configurations.
Fixes a bug where adding Git packages could fail with custom R startup files present.
Fixes an issue with rendering SVG images in package READMEs.
Fixes an issue where build-id files installed in /usr/lib/.build-id/ could conflict with other RStudio products and cause install errors.
Fixes an issue where out-of-sync system requirements could prevent the server from starting. This improves support for running RStudio Package Manager in offline (air-gapped) environments.
Updates the admin guide, licenses, and news documentation to use mkdocs.

1.1.2

February 26, 2020

RStudio Package Manager 1.1.2 includes beta support for pre-compiled R package binaries for Windows. Windows R package binaries can be installed much faster without the need to install system dependencies. More details are available in the admin guide.
Support for CRAN repos with versions older than 1.0.6 has been removed. Updating to version 1.0.6 or later is now required for CRAN support.
Eviction Policies
- Adds the ability to configure eviction policies that control the lifetime of stored objects. Eviction policies can be used to keep server disk usage to a minimum. Learn more in the admin guide.
- Startup after upgrading RStudio Package Manager may take some time since all stored objects will be recorded in the database. If you are upgrading multiple nodes in a cluster, please allow the first node to completely start up before starting additional nodes.
Fixes a bug where a bad database connection to PostgreSQL or SQLite would cause a panic.
Support for TLS 1.3. Access to this TLS version is available without additional configuration.
The setting HTTPS.ExcludedCiphers has been removed and is no longer supported. The HTTPS.MinimumTLS setting should be used to specify a minimum accepted TLS version. We recommend running a secure proxy when your organization has more complex HTTPS requirements.
Adds support for serving precompiled binary packages for CentOS/RHEL 8.
Adds support for listing system requirements of packages on CentOS/RHEL 8.
Fixes a bug where shutting down the server sometimes resulted in orphaned job launcher processes.
Adds a migration utility that can be used to migrate to a different database provider. Learn more in the admin guide.
Fixed a bug in which CPU usage of the rstudio-pm service would increase over time when using SQLite as a database.

1.1.0.1

November 22, 2019

Fixes a bug that both impacted the server performance and resulted in potentially serving incorrect binaries when fetching binary packages for a non-current checkpoint.

1.1.0

October 31, 2019

Adds two new configuration settings, Server.PackageRewriteCompressionLevel and Server.PackageRewriteBufferSize that can be used to improve performance when installing packages in local sources. Learn more in the admin guide.
Deprecates the --dryrun flag that was required when updating packages to curated-CRAN sources.
The rspm-offline-downloader now supports downloading Linux R package binaries for offline environments. Learn more in the admin guide.
Adds a new Proxy.URL configuration option to have RStudio Package manager use an outbound server proxy when making HTTP and HTTPS requests.
Stops support of Ubuntu 14 (Trusty Tahr). With the Ubuntu EOL, and RStudio six-month support coming to a close, we will no longer be testing or supporting RStudio Package Manager on this version of Ubuntu.
Deprecates the CRAN.SyncMode setting. Future releases will not support eager syncing for CRAN and curated-CRAN sources. The air-gapped installation approach can be used for situations that require preemptive downloads for CRAN or curated-CRAN packages. Learn more in the admin guide.
Fixes a bug preventing git packages with a large number of tags from building.
Adds support for installing very large packages in local sources.
Adds support for SUSE Linux package binaries. See the repo setup page for more information.

1.0.14

October 2, 2019

This release includes bug fixes and significant performance improvements.
Deprecates the --dryrun flag that was required when adding packages to curated-CRAN sources.
Adds support for RHEL 8.

1.0.12

September 10, 2019

Beta: Introduces support for linux package binaries. Precompiled package binaries will be available for the majority of CRAN packages using R 3.4, 3.5 and 3.6 for Ubuntu 16.04 (Xenial), Ubuntu 18.04 (Bionic) and CentOS/RHEL 7. Please refer to the admin guide to start serving binaries.
Introduces a service log which can be used to analyze how Package Manager is serving source vs. binary packages. Learn more in the admin guide
RStudio Package Manager installers are now signed. Our signing key is available on the RStudio website. The Installation instructions in the RStudio Package Manager Admin Guide explains adding the RStudio key to your Linux distribution.
Fixed bugs related to building Git packages and added log messages which can help diagnose Git problems more quickly.

1.0.10

July 8, 2019

Introduces a new CLI command to list system requirements for packages in a given repository. Run rspm list requirements --help for more information.
The system requirements for a repository are also available in the UI. See the Setup page for a respository in the UI.
Updated UI Javascript code to address moderate CVEs published by NPM.
Fixed a bug that prevented package system requirements from displaying correctly in certain circumstances.
Fixed bugs and improved performance for transaction handling (i.e. “pinning” a repository to a certain date).
NOTICE: When using Postgres, RStudio Package Manager now verifies that a minimum version of 9.4 is being used. A warning message will be logged if the version of Postgres being used is older. The 9.4 minimum version is also noted in the PostgreSQL section of the Database chapter of the Admin Guide.

1.0.8

April 18, 2019

RStudio Package Manager now helps users find and install system dependencies of R packages for supported Linux operating systems. Installation commands for known system dependencies are displayed on the package page. System dependency information will be available after syncing. See the Admin Guide for more details.
The process for setting up an air-gapped environment is simplified by using a new tool which does not require the AWS CLI. See the Admin Guide for updated setup instructions.
Running RStudio Package Manager in a clustered environment using S3 as a backing filesystem is now officially out of beta.
Improvements to logging when Git builders fail will help to more quickly diagnose problems with the build environment.
Package listing and search is now much faster.
Rendering package README files is improved and several layout bugs are fixed.
RStudio Package Manager is now available for SUSE Linux Enterprise 15.

1.0.6

March 11, 2019

BREAKING: Air-gapped customers are required to fetch the new v3/1 schema after upgrading before syncing the CRAN source. See the Admin Guide for more information.
Important updates and fixes to Package Manager’s CRAN source. Past CRAN checkpoints will remain available. Users will see corrected browsing behavior for a small percentage of packages for new syncs.
README files are rendered in the web page for each package. READMEs for packages in existing local and Git sources will be extracted automatically upon upgrading. READMEs for the CRAN source will be available after syncing. READMEs for existing packages in curated-CRAN sources will be unavailable, but, after syncing the CRAN source and updating the curated-CRAN source, READMEs for new and updated packages will be available.

1.0.4

January 25, 2019

BREAKING: The R processes that build Git packages now run inside a sandbox for security. Only customers using Git sources are affected. SUSE/Ubuntu users will not require any changes. If you are using CentOS/RHEL, you will need to either (a) configure the Git.AllowUnsandboxedGitBuilds = true configuration setting, (b) reconfigure RStudio Package Manager to run as root, or (c) enable user namespace support (CentOS/RHEL 7 only). If you are running RStudio Package Manager in a Docker container, you will need to either (a) start the container with the --privileged flag or (b) configure the Git.AllowUnsandboxedGitBuilds = true configuration setting. Please consult the Admin Guide for more information.
Archived packages (packages with no current versions) are now displayed in the RStudio Package Manager UI.
The Setup page in the UI now includes a calendar that allows you to freeze your set of packages to a particular checkpoint.
Added beta support for shared storage using AWS S3. See the Admin Guide for more information. IMPORTANT: AWS S3 support is in beta. Please do not use S3 for production data at this time.

1.0.2

December 5, 2018

Git packages can now be built from subdirectories within a Git filesystem.
Git packages can now use SSH keys with or without a passphrase.
SSH connections when performing Git operations now utilize a private SSH agent process for improved security.
Git packages now include the commit SHA in the package DESCRIPTION file for reference.
Fixed a bug where Git commits could be built out of order if they were recorded in different timezones.
Fixed a bug where Curated CRAN sources might need an CRAN update prior to an initial sync.

1.0.0

October 17, 2018

RStudio 1.0 is the first generally available release of the product. RStudio license terms, conditions, and limits apply. Contact sales@posit.co for more details.
RStudio Package Manager can automatically track R packages in Git (including GitHub, Bitbucket, and GitLab). Tracking Git endpoints requires a valid installation and configuration of R. Private endpoints are supported using ssh-keys. See the Admin Guide for details.
Improved messaging for CLI commands and CRAN sync operations.
CRAN synchronization will not happen until a manual sync has occurred or a repository subscribes to a cran source or curated cran source.
BREAKING: A sync schedule of 12:00 AM (server time) daily is now enabled by default. To only have manual syncs, configure a blank SyncSchedule in the [CRAN] configuration. See the Admin Guide for details.

0.7.0

September 4, 2018

BREAKING: The new default minimum TLS version for the HTTPS listener is “1.1”, in compliance with PCI Data Security Standards. Previously, TLS 1.0 was enabled by default. Additionally, it is now possible to specify the minimum TLS version using the HTTPS.MinimumTLS configuration setting.
Fixed a bug in which CPU usage of the rstudio-pm service would increase over time.
Added a new configuration flag, HTTP.ForceSecure, that makes RStudio Package Manager set the Secure flag on all of its cookies. This provides extra security when running RStudio Package Manager behind a HTTPS-terminating proxy. HTTP.ForceSecure also sets the Strict-Transport-Security header on all web connections.

0.6.0.1

August 2, 2018

Fixed a bug in which empty files were being served for packages.rds and packages.gz files in the /bin/ directory. This was causing problems in R versions 3.4.4 and greater when a user attempted to install more than one package.

0.6.0

July 31, 2018

Added Usage Statistics for analyzing package downloads and package licenses over time.
Compress (gzip) the packages and archive RDS files before serving them to clients.
Added row.names to the packages RDS file.
The CLI list sources output now includes source types.
Added a CLI list command that outputs a tree of all repos and sources.
Added a CLI fetch command to initial eager package fetching.
The CLI now uploads local packages using multi-part uploads to the API. Only the CLI needs permission to read files you are uploading, and relative paths are supported.
Added support for minor migrations for CRAN sources. Minor migrations are typically used for supplementing CRAN sources with additional metadata.
Added the SystemRequirements and NeedsCompilation fields to CRAN sources.
Improved the informational and error messages displayed during curated CRAN operations.
Fixed a bug that resulted in reading the wrong package DESCRIPTION file in some CRAN packages that include DESCRIPTION files at multiple paths.

0.5.0

June 28, 2018

BREAKING: RStudio Package Manager’s support for CRAN metadata was simplified. RStudio Package Manager now includes a single, default CRAN source and the fetch mode and sync schedules are defined server-wide in the configuration file. If you have existing CRAN sources, they will be dropped when upgrading. A new cran source will be created automatically. Use the CLI to subscribe existing repositories to the new cran source and to sync the new cran source. Example: If you had a repository named prod that subscribed to an CRAN source named cran-src, you will need to run: rspm subscribe --repo=prod --source=cran and rspm sync after upgrading.
BREAKING: The CRANTimeout and FetchTimeout configuration properties have been moved to a new [CRAN] configuration section. If you included either of these two properties under your [Server] configuration section, you will need to move them to a new [CRAN] configuration section.
RStudio Package Manager now includes curated CRAN sources, giving administrators the ability to host approved subsets of CRAN instead of taking an all-or-nothing approach. Administrators add packages, preview changes, and even perform dry runs before running updates. The admin guide contains examples and quick start guides.
The [CRAN] configuration section now includes SyncSchedule and SyncMode settings. The SyncSchedule setting accepts a crontab format for scheduling synchronization of the CRAN source. The SyncMode setting defaults to lazy but can be configured as eager for eager package downloading. The sync schedule and mode were previously configured using the CLI.
Admins can now edit source names, repository names, and repository descriptions using the edit CLI command.
Added an [API] configuration section that includes the settings MaxApiResults and DefaultApiResultsLimit for configurable API result limits.
Added documentation for air-gapped environments. See the Admin Guide for details.
Eliminates external fonts in the UI.
The activity page for a CRAN source now lists the historical date represented by a sync operation instead of the date the sync occurred.
Removed the CLI sync-wait command and replaced it with a flag. You can now run rspm sync --wait instead.
Better support for the URL property that appears in many CRAN package DESCRIPTION files. This property appears in CRAN packages as URL, Url, and url, which are all now supported.
The package date for archived packages is now displayed in the UI.
The CLI reorder command allows reordering source subscriptions for a repository. This allows you to change the priority for resolving conflicts when two sources include a package with the same name.
Fixed a bug that prevented using the UI through a proxy that prepends a prefix to the RStudio Package Manager URL.
Include Content-Length and Last-Modified headers when serving a package tarball.
Support for Ubuntu 18.04.
SUSE Enterprise Linux 12 SP3+ Support.

0.4.0

May 3, 2018

BREAKING: Sources can no longer be hidden. Since repositories can subscribe and unsubscribe from sources (since 0.2.0), there is no need to hide sources. Sources that were previously hidden will no longer be hidden after upgrading to this release. If your repositories subscribed to hidden sources that should remain hidden, please unsubscribe those repositories from the hidden sources before upgrading.
Added the ability to version and migrate CRAN sources. This allows RStudio Package Manager to replace outdated or flawed CRAN sources without losing transaction history.
Added a /ping endpoint to allow services to more easily monitor the service’s status. It always responds with an empty JSON message and a 200 status code.
Sources cannot be deleted when associated with any repositories. A repository’s source subscriptions and unsubscriptions are all recorded permanently. To preserve a repository’s immutable historical records, no sources that were ever associated with an existing repository may be deleted. If you need to delete a source, you must first delete any repositories that at any time subscribed to the source.

0.3.0

March 26, 2018

BREAKING: This release incorporates major improvements to sources typed as cran. Packages in existing sources typed as cran will be removed when upgrading. Administrators should initiate synchronization for any sources typed as cran after upgrading.
KNOWN BUG: When using an NFS share for [Server].DataDir, there can be delays of up to 60 seconds when initailly serving particular files including the PACKAGES files for a particular repository. When using the “lazy” sync mode with CRAN, this delay can also occur the first time a version of a package is served. This latency can be improved by shortening the length of time attributes are cached on your NFS clients (see the acdirmax and noac NFS mount options). We will work to resolve this latency in a subsequent release.
Added support for multiple current versions of CRAN packages.
Support synchronizing multiple CRAN checkpoints simultaneously. This greatly reduces the time to synchronize a CRAN source.
CRAN checkpoints are cached to avoid redundant downloads. This greatly reduces the time to synchronize CRAN sources.
Introduced better logging configuration options to provide helpful logging during CRAN synchronization without overwhelming logs. Also added trace-level synchronization logging.
Added a sync-wait command to the CLI. This command lets you wait for synchronization to complete after you initiate a synchronization.
The RStudio Package Manager service now manages its /var/run/rstudio-pm directory correctly to avoid missing domain socket files on operating systems that use temporary file systems for the /var/run directory.
More consistently sort/order packages. Previous RStudio Package Manager releases ordered packages inconsistently when using PostgreSQL vs. SQLite.
Sort archived packages by version in the RStudio Package Manager Web client.
Fixed a bug that prevented package link (depends, imports, etc.) versions from being displayed in the RStudio Package Manager Web client.
Added the ability to specify a description for repositories, which are displayed via the CLI and the UI.

0.2.0

January 29, 2018

The RStudio Package Manager service now runs under an unprivileged account. By default, the service runs under the rstudio-pm account. See the admin guide appendix on changing the RunAs User if you need to adjust the service account.
BREAKING: Upon upgrading, if you previously configured RStudio Package Manager with alternative data directories, cache directories, log files, or .gcfg locations, you will need to manually change ownership on these files/directories to the new rstudio-pm service account. See the admin guide appendix on changing the RunAs User for more information.
BREAKING: The internal structure of Package Manager has changed. Repositories no longer contain packages directly, but instead repositories are composed of one or more “sources”. Sources are typed as either local or cran. See the admin guide for more details. Due to this change, upgrading to 0.2 will wipe all existing repositories. Administrators should recreate the repositories using the source + repo model. Any CRAN packages that were previously downloaded will be retained on the server and can be accessed after a new repository is configured. Local packages will need to be readded. Additionally, the cache directory, /var/lib/rstudio-pm/cache can be removed prior to upgrading to save disk space.
BREAKING: The administrator command line interface (CLI) has been significantly refactored for easier use. Any scripts developed with the previous CLI should be rewritten. The new CLI does not require root. Instead, admins should be part of the rstudio-pm unix group. Instructions for changing the group are included in the admin guide.
BREAKING: Package Manager now tracks the number of downloads for each package. To do so, a new database was added for storing metrics. Servers using Postgres will need to create a new database and populate the [Postgres].MetricsURL configuration option or disable metrics by setting [Server].MetricsEnabled = false. Servers using the SQLite database (the default) will not need to alter their configuration; a new database will be created alongside your existing one.
The [Server].MetricsRetention configuration option specifies when to reap metrics that have expired.
The Package Manager web interface displays additional information about packages, including prior archived versions.
In version 0.1.0 users were prompted to name the repository RSPM. The new Overview page suggests naming the repository according to the repository name on Package Manager.
A date parsing error that occurred when adding local packages was fixed.
A number of bugs were fixed to properly sync CRAN packages including properly archiving prior package versions and correctly displaying the Depends, Suggests, and Imports fields.

0.1.0

November 20, 2017

This is the initial alpha release of RStudio Package Manager.