Posit Package Manager Release Notes

Please submit the Posit support form with questions about the described changes.

2026.08.0

August 10, 2026

Breaking

• #19538 Identity federation now matches a provider’s Audience and Subject against the entire claim in the token, rather than anywhere within it. A provider pinned to Subject = "repo:my-org/my-repo:ref:refs/heads/main" previously also accepted a branch named main-patch, which discards the review controls that branch was relied on to provide. Such a provider now accepts only the branch it names. Both settings are still regular expressions, so a pattern that deliberately matches a family of identities, such as repo:my-org/my-repo:.*, continues to work. Add .* wherever the claim can carry additional text. Package Manager logs a warning at startup naming each provider that matched more before this change than after. See Identity Federation.

• #19420 License based blocklist rules can now evaluate differently for a small number of Python (PyPI) packages, in either direction. Package Manager falls back to the license in its own repository data when a package’s own metadata carries none. That fallback data was incomplete, so some packages had no license at all and no rule could match them. It is now complete. A rule for a specific license can now block a package it previously served. A rule for unknown licenses, such as --license-types=Unknown, no longer matches those packages, so they are now served. If you rely on an unknown license rule to restrict what a repository serves, review your repositories after upgrading, because that case removes a restriction and produces no error. Roughly 5,000 packages out of about 933,000 are affected. Packages whose own metadata already carried a license are unaffected, as are all rules that resolved a license before.

New

Web Interface

• #18718 Adds a Settings > Overview page where administrators can review system and license details, check feature status, filter features, and open related documentation.

  See Overview page for details.

• #18898 #18903 #18905 The What’s-New page and the online Release Notes share a release-timeline layout and render from the NEWS.md that ships with Package Manager. Issue references render as chips; each release’s New / Fixed / Breaking sections appear as color-coded badges in a fixed order.

Packages & Repository

• #17789 Bioconductor packages are now served as precompiled binaries for Windows, macOS, and Linux, matching the existing CRAN binary support. Binaries are provided for the Bioconductor software packages repository; packages without a binary for a given distribution and R version continue to be served from source. See Binaries for Bioconductor Sources.

• #18373 The Offline Downloader can now mirror Bioconductor binary packages with get bioconductor --include-binaries, so air-gapped installations can install Bioconductor binaries instead of building every package from source. Each Bioconductor version pins a single R version, so the R versions are selected automatically; use --r-versions to narrow the download. Binaries are available for the main Bioconductor software repository. Mirror Bioconductor and CRAN binaries into the same destination directory, because Package Manager serves both from one location. See Air-Gapped Installations.

• #17061 Portable Linux binary packages are now generally available. The manylinux glibc 2.28+ distribution is no longer labeled as a preview on the Setup page. See Portable Linux Binary Packages.

• #15169 Portable Linux binary packages now record the system libraries they bundle. Each package includes a CycloneDX software bill of materials (SBOM) that vulnerability scanners can use to audit those libraries, and the package’s DESCRIPTION summarizes them in a Built/SystemLibs field. Binaries built before this change do not include this metadata. See What is bundled in these packages?.

• #18526 The offline downloader’s get cran and get bioconductor commands now accept a --file-in requirements file and download the listed packages together with all of their dependencies. (For PyPI, --file-in remains a literal package list, without automatic dependency resolution.)

• #19421 The Offline Downloader can now limit how much package version history it downloads. Add --since=YYYY-MM-DD to keep only the versions that were current on or after that date. This works for a full mirror and, together with --file-in, for a chosen set of packages. Version history is the largest factor in the size of a mirror, so this can reduce the download substantially. The date is the mirror’s retention start: pass the same date on every run, so each run keeps everything the previous run kept plus whatever is new. No package is dropped entirely: a package with no release on or after the date still gets its most recent earlier version, so it remains installable. The date can also be set in the requirements file. For CRAN and Bioconductor, --starting-snapshot can no longer be combined with --file-in, because the package index would list versions the download did not contain. See Air-Gapped Installations.

• #18820 New installations now create a cran (R) repository and a pypi (Python) repository automatically on first startup, so Package Manager is ready to serve packages without any manual setup. These are configured in the [Repos] section of the default rstudio-pm.gcfg; comment them out or rename them to change this. Existing installations are unaffected, since the configuration file is not overwritten on upgrade. If a license does not permit another repository, Package Manager logs a warning, skips the repository, and starts normally.

• #18820 The default rstudio-pm.gcfg configuration file that ships with Package Manager now documents the most commonly used settings inline, each with a short description, a direct link to the configuration reference, and either its default value or an example to edit. This includes the [Repos] section for automatically creating CRAN, PyPI, Bioconductor, and Open VSX repositories on startup.

• #18342 rspm update for a curated CRAN source in the default (non-strict) mode no longer aborts when the requirements file contains a package that isn’t available at the selected snapshot. Valid packages are still installed, and the unresolved entries are reported as warnings in the command output. The update still fails if no packages can be resolved. Strict and no-archived sources continue to fail on unavailable packages, since those modes exist to enforce stricter package constraints.

• #18937 The --snowflake-connection flag on rspm login and rspm login sso is now optional when authenticating to a Snowflake instance. When the flag is omitted, Package Manager uses the SNOWFLAKE_DEFAULT_CONNECTION_NAME environment variable or the default_connection_name setting from your Snowflake configuration, matching the Snowflake CLI. Logging in to a Snowflake instance with no connection resolved now fails with a clear message.

• #18644 #19197 The package details page now shows dependencies for every version of a PyPI package, not just the latest. This information is served from Package Manager’s own repository data, so it is available for any snapshot (including older and pinned dates) and in air-gapped deployments, without contacting an external service.

• #19158 Local and Git Python package detail pages now show dependencies for every version, not just the most recent one.

• #19137 Python package listings and search results now show each package’s license and release date.

• #19367 Curated PyPI package listings and search results now show each package’s license and release date, matching the full PyPI mirror. Existing curated PyPI sources pick this up automatically the first time they are accessed after upgrading.

• #19368 PyPI package listings and search results now show each package’s license and release date for packages from local and Git Python sources, matching the full PyPI mirror and curated PyPI sources. Packages that were uploaded before upgrading pick this up during a one-time capture that runs when the server starts. On an installation with a very large number of such packages, that capture can add noticeably to the first startup after upgrading; the new Migration.SkipPythonLicenseCapture option skips it, leaving those packages without a license or release date until it is allowed to run on a later restart.

• #19076 Package Manager no longer writes cached R package listings to disk. These listings are now served directly from the in-memory package graph and memoized in memory, which substantially reduces the number of objects accumulating in the cache and the amount of work required to clean them up. Package listing and filtering requests are also faster and use less memory than in previous releases.

• #19494 The PyPI simple index now publishes each file’s upload time and size, so uv’s --exclude-newer option works against Package Manager. Previously uv had no publication date to compare against and excluded every candidate file, so resolving with --exclude-newer failed outright rather than resolving to the packages available on the given date. Mirrored PyPI packages report their original upload time from PyPI; packages from local and Git Python sources report when Package Manager received or built them. Files that were added before Package Manager began recording upload times have no date and are still excluded by --exclude-newer. Other clients, including pip, ignore the new information.

Server & Storage

• #19486 Package Manager now reports when it cannot serve a binary package because it could not resolve one of the package’s compiled-code dependencies. Computing the key that identifies a package’s binary requires resolving every package listed in LinkingTo; when one of them is not in any of the repository’s sources, it is left out of the calculation, the resulting key matches no published binary, and the package is served from source with nothing to indicate why. Package Manager now logs a warning naming the package and the dependencies it could not resolve, and counts the occurrences in the ppm_graph_ash_unresolved_deps_total metric. Each package, with its set of unresolved dependencies, is logged once per server process, so a repository in this state does not flood the log. The Bioconductor case that motivated this is fixed separately in the same release, so the warning should now be rare; it remains as a diagnostic for any other repository whose sources cannot resolve a compiled-code dependency.

• #19076 Cached binary index data no longer accumulates. Package Manager previously wrote a new cache object each time the upstream binary index changed and kept the old ones, which on a long-running server grew to tens of thousands of objects and tens of gigabytes. It now keeps one object per R version and distribution and replaces it in place, and holds the index in memory in a substantially more compact form, reducing both cache storage and memory use. Existing binary index cache objects are left for normal cache cleanup. The new Server.BinaryIndexMemorySize setting bounds how much binary index data is held in memory, defaulting to 1 GB.

• #19242 Server log messages now use static message text with structured key/value attributes (for example, error=, path=, manifest_type=), making logs easier to search and machine-parse. The log level and information content of every message are preserved. Tooling that matches on exact log message strings may need updated patterns.

Fixed

• #19486 Bioconductor packages that link against a CRAN package are now served as binaries. Package Manager identifies a binary by a key computed from the package’s checksum and the checksums of everything it links against. A Bioconductor repository subscribes only to a Bioconductor source, so CRAN packages such as Rcpp, BH, and cpp11 could not be resolved and were left out of that calculation. The key no longer matched the one recorded when the binary was built, so Package Manager reported that no binary existed and served the package from source instead. It now resolves those dependencies against CRAN when computing the key, matching how the binaries were built. On Bioconductor 3.23 for R 4.6 this makes about 280 additional packages available as binaries, including DESeq2, BiocParallel, BiocNeighbors, and BiocSingular. No rebuilds are required, because the binaries were already published. Packages that were already served as binaries are unaffected. Serving these binaries requires a CRAN repository on the same server, because Package Manager synchronizes a source’s package data only while a repository exposes it, which keeps an installation from retrieving data it has not opted into. A server that offers Bioconductor without CRAN continues to serve the affected packages from source, and logs a warning naming the missing data. See Cross-Ecosystem Binary Dependencies.

• #19539 The package details page now shows binary availability for Bioconductor packages. The Package Files section previously reported that binary files were not available for any Bioconductor package, and offered no way to choose a binary distribution, even when a binary had been built. It now provides the same binary download links, availability message, and distribution selection as a CRAN package. The R version is taken from the selected Bioconductor version, because each Bioconductor release pairs with a single R version; it is shown on the page rather than offered as a separate choice, so it can no longer be set to a version the binaries do not correspond to. Binaries are available for the main Bioconductor software packages repository; packages in the annotation, experiment, workflow, and book repositories continue to be served from source.

• #19540 The binary availability APIs no longer report a binary for a Bioconductor package that cannot be served as one. Package Manager builds binaries only for the main Bioconductor software packages repository, but the package and repository binary endpoints answered from the binary index alone, which is shared across every Bioconductor repository. A package in the annotation, experiment, workflow, or book repositories could therefore be reported as having a binary, while actually requesting that binary returned an error on Windows and macOS, or quietly fell back to source on Linux. Those endpoints now report no binary for such packages. They also now document the bioc_version parameter that they require for a Bioconductor repository, and the equivalent tools now accept it, so they can be used with a Bioconductor repository at all.

• #19404 Package Manager no longer stalls when it first serves a Bioconductor version whose package data has not yet been loaded. Loading that data could block other work across the whole server, including repository updates and unrelated requests, until the load finished; requests could take minutes or appear to hang. Bioconductor was most often affected because Package Manager loads the data for only the three most recent versions at startup and loads the rest on first use.

• #19396 Blocklist rules that match on license now block Python packages that declare their license using the PEP 639 License-Expression field without also providing a License :: classifier. For these packages, Package Manager could not determine a license and rules such as --license=gpl or --license-types=GPL-2.0-or-later did not match, so the package was served even though a rule should have blocked it. Package Manager now resolves the license from its own repository data when the package metadata does not carry one. As before, license rules apply to the license of the version Package Manager resolves for a package; to block a specific older version, block by package name and version instead. Administrators using license-based blocklist rules should review which packages their repositories serve after upgrading: packages that were previously served despite a matching rule will now be blocked, which may affect installations that depend on them.

• #19457 License and age blocklist rules are now reported correctly by the filter/packages API for PyPI mirror and curated PyPI packages. The endpoint previously reported these packages as not blocked, and reported no license for them at all, even when a matching rule was in force and the package could not actually be downloaded. Installation was never affected: the download path and the pip index enforced the rules correctly throughout, so this affected tooling that asks Package Manager what is blocked rather than what a client receives. Local and Git Python packages are corrected by a separate change in this release. Packages whose license information came from the mirrored package metadata are also now reported correctly when that metadata does not name a license but the repository data does, which is the common case for packages that declare their license the way PEP 639 describes.

• #19390 The package details page for a Python package that declares its license using the PEP 639 License-Expression field, without also providing a License :: classifier, now shows the license instead of UNKNOWN. The package listing already showed it correctly, so the two views disagreed.

• #19368 License and minimum-age blocklist rules now correctly report local and Git Python packages as blocked in the package listing (the filter/packages API and other repository metadata integrations). The listing previously reported these packages as available even when the same rule correctly blocked them from being downloaded.

• #19154 Corrected PyPI license resolution for three GNU classifiers. Packages classified GNU Lesser General Public License v3 (LGPLv3) now resolve to LGPL-3.0-only instead of the more permissive LGPL-3.0-or-later, and the versionless GNU General Public License (GPL) and GNU Library or Lesser General Public License (LGPL) classifiers now resolve to Unknown rather than fabricating a specific version (GPL-3.0-only/LGPL-3.0-only). A rule written as --license-types=Unknown therefore matches those packages where it previously did not. License expressions separated by non-ASCII whitespace (such as a non-breaking space) are now parsed correctly.

• #19432 Air-gapped installations, which serve repository data from a local directory, now respond to binary package index requests substantially faster. Package Manager previously read and checksummed the entire binary index file, up to about 12 MB, on every such request, and did the same for the whole package file on each download that was not already cached. It now reuses the checksum it already computed while the file is unchanged, and recomputes it as soon as the file changes.

• #19426 The air-gapped installation guide now states that an Offline Downloader --file-in requirements file is the complete list of what the repository serves, not a list of packages to add. Every download rebuilds the package index to match the file, so downloading with a file that lists only a newly added package produces an index listing only that package, and copying it into the destination directory replaces the index that listed the others. The omitted packages’ files are not deleted, so restoring the full requirements file and downloading again recovers the index without re-transferring them. This applies to CRAN, Bioconductor, Python, and Open VSX. See Air-Gapped Installations.

• #19405 The storage requirements for air-gapped installations now reflect measured sizes. CRAN requires about 170 GB rather than the 120 GB previously documented, so administrators sizing a volume from the documentation are no longer likely to under-provision. The air-gapped installation guide now also describes how to use the Offline Downloader’s --skip-source flag to add binary packages to an offline environment that already has the source packages.

• #19364 Air-gapped installations now show the dependencies for every version of a Python package, matching a connected server. The Offline Downloader’s get pypi rewrites the PyPI manifest and did not carry the per-version dependency information through, so package details pages on an air-gapped server showed no dependencies for a release. Re-run get pypi to add this information to an existing dataset.

• #19356 The Offline Downloader’s --skip-source flag on get cran now works. It was accepted but had no effect, so a download that specified it still retrieved every source package, costing the time, bandwidth, and disk space the flag exists to save. Source packages are now skipped as documented, while the manifest, its metadata, and the binaries are still downloaded.

• #19355 Offline Downloader datasets created with get cran --include-binaries now serve binary packages. The downloader saved a binary index in an older format than the one Package Manager reads, so an air-gapped server found no index and quietly served every package from source, as though no binaries had been downloaded. Re-run get cran --include-binaries to add the correct index to an existing dataset. Datasets created with --file-in were not affected.

• #19433 Package Manager now correctly detects changes to binary package data when the configured manifest URL points at a service that does not return an ETag response header, which has been reported with some third-party repository products such as older JFrog Artifactory versions. Previously it substituted a value that it changed once every 24 hours regardless of whether anything upstream had changed. As a result, an updated binary index, Bioconductor manifest, Bioconductor configuration, or supported-distributions list could be ignored for up to 24 hours, so binary package checksums in PACKAGES files could be out of date. Each node in a cluster also substituted a different value, so nodes could not share this cached data, each repeatedly re-fetched it, and the Bioconductor manifest, Bioconductor configuration, and supported-distributions caches accumulated a separate copy per node every 24 hours. Package Manager now derives the value from the modification time and size that such a service does report, so every node agrees and an upstream change takes effect immediately. For a service that reports a size but no modification time, the value is additionally refreshed once every 24 hours, because a size alone cannot always distinguish two versions of a file. If a service instead reports a new modification time on every response, Package Manager notices that the value does not correspond to a change in the data and goes back to checking once a day, so such a service does not cause repeated downloads. A service that reports an ETag is unaffected.

• #18715 Binary package builds now resolve the system dependencies for several packages that under-declare them in their SystemRequirements (Rmpi, tkrplot, Rhdf5lib, pqsfinder, SICtools, HilbertVisGUI), so their binary packages build successfully.

• #17064 The Setup page URL now identifies the manylinux glibc 2.28+ distribution as manylinux_2_28 rather than centos-8.

• #19439 A client that disconnects or times out while waiting for a source PACKAGES, binary PACKAGES, or archive.rds index no longer keeps server resources tied up until that index finishes being built. Package Manager builds each index once and shares it with every request waiting for it, but a waiting request could not give up early, so a client that went away still held a request slot and its share of the package data for as long as the build took. Requests that go away are now released immediately, and the shared build still runs to completion and is cached for the requests that are still waiting and for later ones.

• #19076 During a rolling upgrade of a cluster, a binary package index request served by a node that has not yet been upgraded now fails immediately with a clear, retryable error instead of stalling for over a minute and then reporting a misleading cache error. The condition resolves once every node has been upgraded.

• #19341 Fixed an issue where a package list interrupted partway through could be stored as though it were complete, causing a repository to appear to be missing packages until its cached data was rebuilt. Interrupted requests now fail and are retried instead of being cached.

• #19324 Fixed an issue where Package Manager could stop responding to requests for every repository shortly after a source finished synchronizing, requiring a restart to recover. This occurred only under concurrent load, in the moments right after a synchronization.

• #19298 Fixed an issue where a single stalled request could prevent Package Manager from serving any further requests for the affected repositories once the next synchronization completed, requiring a restart to recover. Requests that stop making progress are now abandoned so that the rest of the server keeps serving, and a synchronization that cannot take over from in-flight requests now leaves the previously synchronized data in place instead of blocking.

• #18494 Deleting a source now frees its in-memory package graph immediately instead of retaining it until the next restart.

• #19002 Fixed a goroutine and database-connection leak in package detail requests for Git and local sources that could exhaust the database connection pool and hang the server.

• #19008 Fixed a goroutine leak in the queue that polls for cached package assets. When a request was abandoned (for example, a client disconnect or a timeout), a background poll goroutine could remain blocked indefinitely; under heavy load these could accumulate and degrade the server.

• #18679 Fixed a rare crash in which the server could abort while serving a package request that overlapped with a CRAN or Bioconductor sync, caused by a data race in the in-memory package graph while a source was being reloaded.

• #18897 Fixed a resource leak where a client disconnecting mid-response from the package filter API for an Open VSX repository could leave server-side work running, which over many interrupted requests could gradually consume server resources.

• #19220 Errors from the automatic repository syncs that run at server startup are now logged. Previously a failed startup auto-sync was silently ignored, leaving no trace in the server logs.

• #19201 Curated CRAN repositories now include the dependencies of every version of a package they contain, not only the latest one. Some packages ship an additional, older version for older releases of R, and if that older version required a package the current one does not, the required package was left out of the curated repository. Installing under an older R could then fail because a dependency was missing. Existing curated CRAN repositories are corrected automatically on upgrade, without needing to be updated or rebuilt; a small number will gain a few packages as a result, most often alongside the R recommended packages such as Matrix, MASS, nlme, and mgcv. Those additions may appear as added packages the next time the repository’s history is viewed.

• #18714 Fixed the JSON package listing API for curated CRAN repositories so an archived package reports the version the repository actually serves rather than the newest version from the underlying CRAN source. Package installation was unaffected.

• #18874 Curated CRAN package history now shows the full version timeline (including previously served versions and their dates), matching CRAN and CRAN-snapshot sources.

• #18930 Curated CRAN package history now lists all of the versions the repository actually serves at each snapshot (the current version plus every older version still available for download), rather than only the versions that had been current at some point. For a non-strict source this is the full archive available at the snapshot; a strict source continues to list only the versions it rolled through.

• #18930 CRAN and CRAN-snapshot package history now lists every version the repository serves at each snapshot (the current version plus older versions still available from the archive), and each snapshot’s headline version reflects the version that was actually current at that date rather than the highest version number available.

• #18971 CRAN-snapshot repository package history no longer shows snapshots newer than the source’s pinned date. A source pinned to a specific snapshot now caps its history at that pin, so the versions shown match what the pinned repository actually serves.

• #19368 Package cards now describe a Python package released today as “today” and one released the day before as “yesterday”. Because a Python release date records a calendar day rather than a time of day, the card previously reported an hour count measured from midnight UTC, so a package added to a local or Git Python source minutes earlier could be described as many hours old, and the figure reset each midnight UTC. Release dates older than a day were not affected.

• #19369 Python version constraints that spell a pre-release in full, such as ==1.0alpha1, ==1.0-beta2, or ==1.0preview1, now match the versions they name. PEP 440 allows alpha, beta, pre, preview, and c as alternate spellings of a, b, and rc, but Package Manager read only the first letter of the long spellings and silently matched no versions at all, with no error reported. Constraints using the short spellings (==1.0a1) were not affected.

• #19291 Package detail pages for locally uploaded and Git-built Python packages load substantially faster, especially for packages with many versions. Package Manager previously re-read and re-parsed the project’s entire version index on every request, and now reuses it between requests.

• #19348 The Python requirement declared by a package (its Requires-Python value, such as >=3.7) is now published correctly in the PyPI Simple index. The data-requires-python attribute is now HTML-encoded as the Simple repository API requires, matching what PyPI itself serves, so pip and similar clients read the full requirement instead of a truncated or empty one and correctly skip distributions that are incompatible with the Python version in use. This affects all Python repositories; upper-bounded requirements such as <3.13,>=3.9 were the most affected. For locally uploaded and Git-built packages the value was additionally published with extra quoting, which is also corrected, in the package details API and the package metadata tools as well. Packages that were already uploaded are corrected automatically; no re-upload is required.

• #19340 On a Python package’s details page, a dependency whose metadata separates the package name from the version specifier with a space (such as six >=1.5) now links to just the package, instead of producing a single broken link containing the version specifier.

• #19331 Requesting the README for a Python package through the API no longer fails with an internal error. Python repositories serve README content directly on the package details page, so these requests now return a clear “not found” response instead.

• #18759 Python (PyPI) package listing, search, and popular-packages operations respond faster and use less memory, now served from a resident in-memory index. The package filter API no longer builds a per-request result-set cache, reducing its memory use.

• #19487 API requests that a repository’s type cannot serve now return a status that names the reason, along with an explanation in the response body. Asking the package releases API about a repository that does not serve Python packages previously returned 500 Internal Server Error with an empty body, which told integrators the server had failed and the request was worth retrying, when in fact the request could never succeed. It now returns 400 Bad Request and names the reason. The vulnerability listing API behaved the same way for a repository whose source is a curated or local Open VSX source. It now returns 501 Not Implemented and reports that vulnerability data is not available for that source type.

• #19488 The Server API Guide now documents how pagination works. The parameters that page through a list of results are _page and _limit, both spelled with a leading underscore, and Package Manager ignores query parameters it does not recognize. A request that pages using a more conventional spelling such as offset, limit, page, or per_page is therefore answered with the first page of results and reports success, which is easy to mistake for a repository that contains only one page. The guide now states this, along with the default and maximum number of results, and that _page=0 and _page=1 both return the first page. See Server API Guide.

• #19406 When a request uses a URL that does not match a repository’s type, the error now explains the mismatch instead of only naming the repository. It states the repository’s type, the type the URL is for, and the URL a repository of that type serves packages at. Requesting a Bioconductor URL such as /myrepo/packages/3.20/bioc/src/contrib/PACKAGES from a repository of type R, for example, previously returned only “Repository type for ‘myrepo’ does not match request URL”, which was easy to mistake for a missing package.

• #18530 Fixed an issue where local-plugins and git-plugins agent-plugin sources could not be renamed via the API or CLI, even though every other admin-named source type could.

• #19219 Fixed an issue where the Package Manager UI’s SourceType enum had drifted out of sync with the server after a new source type was added.

• #18785 The license expiration warning banner now uses an opaque background so its text stays legible when page content scrolls behind the sticky banner.

• #18534 On the homepage, pressing Escape in the package search field now only closes the type-ahead dropdown. Typing again reopens it, so you no longer have to click out of the field and back in to keep searching.

• #15500 Opening a link to a repository that doesn’t exist, or one you don’t have permission to view, no longer quietly sends you to a different repository. Package Manager now shows a clear “Repository Not Found” page, so it’s obvious when a link is wrong or when you may need to sign in to see that repository.

• #17731 On the OpenVSX repository Setup page, the environment options are reordered and relabeled so Posit Workbench users are directed to the right instructions: “Positron or VS Code on Posit Workbench” now appears first, followed by “Positron on desktop”, then “Other VS Code compatible editors”. Previously the first option (“Positron”) could be mistaken as covering Positron running on Workbench.

• #18989 Fixed an issue where uploading a VS Code extension whose icon is stored under a subdirectory (such as images/icon.png) could leave the icon file behind in storage if a later stage of the upload failed. The failed upload’s icon is now cleaned up along with its other files.

• #19252 On the homepage, selecting a suggestion from the type-ahead dropdown for an Open VSX repository — by click, Enter, or ⌘-click / middle-click — now navigates to the extension’s publisher.name page instead of a URL built from just the short name, which failed to load. Suggestions now show the extension’s display name with its publisher.name identifier beneath it, matching the results list.

• #18501 Mistyping a subcommand under an rspm grouping command (such as rspm create git-builde) now reports the unrecognized command with a “Did you mean” suggestion, instead of a misleading “unknown flag” error pointing at an unrelated flag.

• #18499 rspm CLI output now describes content using the noun that matches the repository or source type. rspm list packages shows an Extensions: header (and “No extensions found.” / “Only showing N extensions” messages) for VSX repositories and sources, and a Plugins: header for agent-plugin sources; the rspm remove capability error no longer says “packages” for VSX and plugin sources; and the rspm create git-builder, rspm edit git-builder, and rspm run build-progress messages now say “plugin” builds/candidates for agent-plugin git sources. JSON output is unchanged.

• #18509 rspm login sso --snowflake-connection no longer fails to read a connections.toml (or config.toml) that contains a top-level default_connection_name key, which the Snowflake CLI writes by default. Previously the entire file failed to parse with cannot decode TOML string into ... Connection, so keypair authentication was unusable unless the file contained nothing but connection sections.

• #18892 The Debian/Ubuntu package now declares its dependency on libcap2, which the bundled license manager requires. Previously, installing on a minimal system that did not already provide libcap.so.2 (such as a stripped-down Ubuntu 26.04 base image) left the license manager unable to start.

2026.06.0

June 30, 2026

New

Agent Plugins

• #17891 Posit Package Manager can now host and distribute AI agent plugins. A new plugins repository type aggregates plugins from local uploads and mirrored git repositories and serves them over a read-only Git endpoint, so Claude Code, VS Code, and npx skills can install them from a Package Manager URL with no additional tooling. AI agent plugin hosting is an experimental feature, off by default. An administrator enables it on the Experimental Features settings page or with rspm config experimental enable agent_plugins.

  • See the Admin Guide for more information on how create an agent plugin repo with local and Git plugin sources.
  • See the User Guide for more information on how to use agent plugins with existing AI tooling.

Redesigned Homepage

• #18261 Redesigns the Package Manager homepage with refreshed branding, a cleaner layout, and a faster way to find what you need. Highlights:

  • Search is front and center, with type-ahead suggestions to jump straight to a package or repository.
  • Browse repositories in list, grid, or grouped views, with favorites pinned to the top.

  This is part of an ongoing investment in a modern, polished Package Manager UI, with more improvements planned in upcoming releases. See the User Guide for an overview of the new navigation.

• #18987 The header adds a Documentation menu (open-book icon, left of the user menu) that consolidates What’s New, Admin Guide, User Guide, and Server API Guide, keeping the footer focused on Terms and Release Notes. The homepage marketing sections are reordered around the redesign’s Posit Team story: the closing Better Together block now sits at the bottom with copy aligned to posit.co/products/enterprise/team, and a new posit::conf(2026) block invites administrators and users to the annual R and Python conference.

• #18240 The Package Manager documentation site now uses the refreshed Package Manager product mark in the navbar and a shortened “Package Manager Documentation” title, matching the cross-product docs branding rolled out on Workbench and Connect.

Experimental Features

• #18048 Package Manager now supports experimental features, which are administrator-enabled previews of in-progress functionality. They are not guaranteed to be stable and may change or be removed in future releases. Enable or disable them from the new Experimental Features pane in the administration dashboard, or with the rspm config experimental CLI commands, without restarting the server.

Packages & Repository

• #18410 Added rspm check-config, a new subcommand that validates the configuration file for syntax errors, unrecognized section or variable names, required file paths, database connectivity, and license status without starting the service or creating any data directories. It reports a [PASS] or [FAIL] result for each check and exits non-zero if any check fails. The run-diagnostics script includes its output, and the server suggests running it when startup fails due to a configuration error.

• #18237 Added a blocklist rule criterion that blocks package versions until they reach a minimum age (a cooldown on newly published versions).

• #18309 Package Manager builds its in-memory package graph substantially faster at startup and after CRAN and Bioconductor syncs, so repositories become ready to serve sooner.

• #18309 #18313 #18335 Performance improvements to package serving. Repositories become ready to serve sooner at startup and after CRAN and Bioconductor syncs, and package requests stay fast under heavy concurrent load.

• #16859 Package index files (PACKAGES, PACKAGES.gz, PACKAGES.rds) are now served directly from the in-memory package graph instead of an on-disk cache, improving multi-snapshot throughput and eliminating on-disk index growth. Note: when Server.MemoryCacheSize is set to 0 (in-memory caching disabled), these index files are generated on demand for each request rather than served from a cache, so deployments that set MemoryCacheSize = 0 to conserve memory may see higher CPU and latency on index requests.

• #18342 rspm update for a curated PyPI source no longer aborts when the requirements file contains a package that isn’t available at the selected snapshot. Valid packages are still installed, and the unresolved entries are reported as warnings in the command output. The update still fails if no packages can be resolved.

VS Code Extensions

• #18311 Added a --namespaces flag to rspm create blocklist-rule for blocking Visual Studio Code extensions via publisher namespaces (e.g., --namespaces=ms-python blocks all ms-python.* extensions). Allows multiple comma-separated namespaces (e.g., --namespaces=ms-python,GitHub blocks both publishers) and can be combined with --exception to create allow lists.

• #17881 The OpenVSX search results page now displays each extension’s publisher.name identifier (for example anthropic.claude) under the extension title, making it easier to disambiguate similarly named extensions. The identifier is highlighted with the rest of the search term matches. Also adds emoji support in the READMEs.

• #18110 Curated VSX sources now automatically resolve and include the transitive dependencies and bundled extensions of allowlisted VS Code extensions.

• #18090 rspm update for a curated VSX source no longer aborts when the requirements file contains an extension that isn’t in the OpenVSX manifest. Valid extensions are still installed, and the unresolved entries are reported as warnings in the command output.

Authentication & SSO

• #16123 Documents single sign-on (SSO) authentication for R workflows using pak 0.10.0 or later. R users can authenticate to Package Manager repositories configured with OpenID Connect via the native SSO support in pak, mirroring the rspm login sso and Python posit-keyring flow.

API

• #16418 Documents the /url endpoint in the Server API Swagger documentation. This endpoint validates source-transaction pins and returns encoded URLs for configuring reproducible package repositories.

Server & Storage

• #17889 Added Prometheus metrics for cluster health (ppm_cluster_state, ppm_cluster_integrity_check_failures_total, ppm_cluster_last_task_run_timestamp_seconds, and ppm_cluster_last_successful_ping_timestamp_seconds) so operators can alert on a missing leader, stalled scheduled work, or a degrading cluster.

• #17889 Added an opt-in /__cluster-health__ endpoint that returns HTTP 503 when the cluster leader has been failing integrity checks for longer than Cluster.HealthCheckTimeout (default 60s, 0 to disable), so a load balancer or orchestrator can restart or drain a stuck leader.

MCP Server

• #18187 Visiting the /mcp endpoint in a web browser now shows MCP setup instructions instead of a 405 Method Not Allowed error.

• #17670 The get_server_info MCP tool now returns a server_url field, so AI agents can reliably determine which Package Manager server they are connected to.

Documentation

• #18224 Added Posit Team installation order guidance to the installation documentation, noting that Package Manager must be installed and configured first when Connect and Workbench use it as their package repository.

• #18223 The reference architecture and installation documentation now include a callout reminding administrators to configure proxy settings when running Package Manager behind a load balancer or reverse proxy.

• #18213 The reference architecture documentation now states that Package Manager requires its own dedicated server and must not be co-located with other Posit products in production.

• #18231 Documented the rspm sync --type=vulns CLI flag in the command’s help output, examples, and the air-gapped administration guide.

• #18099 Added CLI examples for creating custom tabs to the rspm create metadata --help output and to the Custom Tabs user guide, showing how to add, update, and remove custom tabs at different scopes.

Fixed

• #18385 The VS Code Gallery API (/vscode/gallery/extensionquery) responds substantially faster under load, especially when browsing Open VSX extensions by category. Package Manager no longer rebuilds and re-sorts the entire Open VSX catalog on every request, reducing both response time and memory use.

• #18621 Fixed an issue where a Bioconductor repository’s archive.rds index included archived packages from every Bioconductor sub-repository instead of only the requested one. Each sub-repository’s archive.rds (for example data/annotation) is now scoped to that sub-repository, matching how its current PACKAGES index is scoped.

• #18592 Fixed an issue where selecting a frozen snapshot date on a curated VS Code extensions repository’s setup page failed with an “unknown source type” error, leaving the setup instructions unable to load. Frozen snapshot URLs now resolve correctly for curated VSX repositories.

• #18040 Fixed an issue where changing the DataDir or PostgreSQL configuration caused an inadvertent encryption key rotation, resulting in a startup failure (failed to decrypt OIDC key). Package Manager now automatically generates a new key instead of crashing.

• #18453 Fixed an issue where requesting information about a package version that is no longer current — a package removed from its repository, or an older archived version of an existing package — could make a /filter/packages request hang for up to 60 seconds and then return an empty response. Such requests now complete promptly: in a request for multiple packages the affected packages are skipped and the rest are returned, and a request for a single such package fails fast with an error.

• #18383 Fixed an issue where an R package dependency expressed with an exact-version constraint (for example pkg (== 1.2.3)) lost its operator and version in dependency-resolution details. Such constraints are now reported correctly.

• #18231 Fixed an issue where a missing or corrupt vulnerability data file (for example after an offline data bundle version mismatch) could make the /vulns and /filter/packages endpoints hang for up to 60 seconds and return errors — even for ecosystems whose data had loaded correctly. Vulnerability data now syncs in the background instead of blocking requests, and an ecosystem whose data is unavailable is skipped (its packages temporarily report no vulnerabilities) rather than failing the entire request #18232.

• #18335 Fixed a rare crash that could occur when package requests arrived while a source was being synchronized.

• #17917 The OpenVSX gallery /vscode/gallery/{publisher}/{name}/latest endpoint now returns only the single latest version of an extension (with all of its platform-specific builds) instead of every version, matching open-vsx.org’s behavior and reducing response size.

• #16756 Fixes binary package requests returning the wrong version for R packages with special paths.

• #17889 Fixed an issue where, after a database failover such as an AWS RDS maintenance window, a multi-node cluster could stop running scheduled tasks (package syncs, builds, and cache eviction) and never recover. The cluster leader now steps down after a sustained loss of cluster integrity so that a healthy node takes over.

• #17889 Fixed an issue where a transient loss of the database connection (for example during a database failover) could cause Posit Package Manager to shut down instead of reconnecting once the database became available again.

• #18135 Generic OIDC clients that authenticate via standard discovery can now use Package Manager’s device authorization flow (RFC 8628). The .well-known/openid-configuration document advertises device endpoints that respect the configured device authentication provider, PKCE is now optional on the device flow, and the token endpoint returns a usable Package Manager API token as access_token when the standard urn:ietf:params:oauth:grant-type:device_code grant type is supplied. Existing first-party clients are unaffected.

• #18192 Documents how to configure Posit Connect to install Python packages from Package Manager using uv or pip.

• #18193 Preferences: Browse Color Themes in Marketplace (and the icon-theme equivalent) populates in Positron and other VS Code clients backed by Package Manager. The gallery serves extension web resources through the resourceUrlTemplate mechanism. If you run your own Package Manager instance, update your editor’s extensions gallery configuration with the resourceUrlTemplate setting from your repository’s Setup page.

• #18188 Fixed the Binary File section’s placeholder message on the package detail page to use consistent styling with the System Requirements section.

• #17299 Package list responses no longer include a zero-value id: 0 field for packages from mirrored sources (CRAN, Bioconductor, PyPI, OpenVSX).

• #18346 Fixed an issue where local-python, local-vsx, git-python, curated-pypi, and curated-vsx sources could not be renamed via the API or CLI, even though they are admin-named source types.

• #18413 Fixed an issue where creating a blocklist rule with an explicitly empty criterion (for example --package-name="") silently dropped that criterion. Combined with another scope such as --source, this could widen the rule to block an entire source instead of a single package.

Deprecated/Removed

• #18220 Package Manager no longer updates the precompiled binary packages for Debian 12 (Bookworm), which has reached vendor end of support.

2026.05.0

May 29, 2026

New

Web Interface

• #17320 Redesigns the package details page across R, Bioconductor, Python, and Open VSX repositories. Each ecosystem now shares a consistent two-column layout — a sidebar of at-a-glance facts (publisher, license, downloads, supported platforms) alongside a main column of expandable sections (README, dependencies, distributions, vulnerabilities, history, metadata) that persist their open/closed state across page refreshes. Highlights:

  • Inline SHA256 with a one-click copy button on every Python distribution row, replacing the previous hash dialog.
  • Distinct visual treatment for blocked (error palette) and yanked (warn palette) distributions, with status badges and inline hashes available on both.
  • Security Vulnerabilities section auto-expands on blocked packages so the reason is visible without an extra click.
  • Version selector inline with the package name on R / Bioconductor pages for switching between architecture-pinned variants.
  • ORCID and ROR-aware author parsing so individual contributors and organizational publishers (e.g., Posit, PBC) surface as clickable links.
  • Version History snapshot cards now surface a per-snapshot change description provided by the backend.
  • Integrated Readme in overview tab to highlight developer notes.
  • Accessibility pass across the redesigned list, details, and modal surfaces: every interactive element is keyboard reachable (including in Safari without the “Use Tab key” preference), expand/collapse controls expose aria-expanded/aria-controls, dialogs announce themselves as such with accessible names, copy actions emit live-region confirmations, decorative icons are hidden from screen readers, and the Other Versions accordions no longer nest interactive children inside their headers.
  • Keyword chips now respect comma-vs-space-delimited inputs. Packages that publish their keywords as a comma-separated string (e.g. "machine learning, data science") preserve multi-word phrases as single chips; packages that publish keywords as a space-delimited string (some R / Bioconductor bioc_views lists) are split into separate chips instead of rendering as one long chip. Affects both the search results card and the Keywords sidebar on package details.
  • Corrected the PyPI package details “Platform” row, which previously displayed Python interpreter tags (e.g. cp310, py3). The sidebar now shows a “Python Tag” row for the interpreter/ABI and a separate “Platform” row whose values are parsed from each wheel’s filename (e.g. manylinux_2_17_x86_64, macosx_11_0_arm64, win_amd64, any).

• #17207 Redesigned and enhanced package search results page. Search term is highlighted and each item contains status badges (blocked, archived, yanked, vulnerability count), publisher or author, license, download count, publication date, and keyword chips.

VS Code Extensions

• #17755 Adds curated VSX sources, allowing administrators to define an allowlist of VS Code extensions served through a curated repository.

Packages & Repository

• #17627 Adds support for Ubuntu 26.04 (Resolute Raccoon).

• #17475 Adds support for R 4.6 binary packages.

API

• #17851 Surfaces archival status of Bioconductor releases through the bioc/versions API. When Bioconductor archives a release upstream, the archived field is set to true on the corresponding entry returned by the endpoint.

• #17568 Adds field-level descriptions to API response types in the Swagger documentation, making it easier to understand API responses.

• #17781 The repository setup page now recommends configuring Posit Connect via rstudio-connect.gcfg and the Package Manager Integration, matching Connect 2026.05.0’s new capabilities. Replaces the previous pip.conf / uv.toml and static-token netrc instructions for the Python and R Connect environments.

Fixed

Web Interface

• #17967 Fixes the package History tab returning an invalid transaction error when clicking “View Snapshot Packages” for PyPI versions uploaded before the repository’s earliest snapshot. The link now points to the first snapshot where the package was observed by PPM.

• #17985 Fixes inconsistencies in the package History tab for PyPI repositories. Versions that were never the served-latest are now labeled “Added” and link to a snapshot URL where the version is actually available, and a higher pre-release (e.g. 6.0rc1) no longer outranks a lower stable release (e.g. 5.0) when picking the latest. Timeline dates also now reflect when each version first became the latest in the repository rather than the most recent observation of that state, which removes spurious gaps between rows.

• #17968 Fixes the package History tab showing an inconsistent source label on a snapshot row in a combined repo when a non-aliased source was subscribed after one of its packages had already been uploaded to the source. The snapshot’s change description and source list now agree.

• #17609 Fixes a Token Management UI bug where choosing an expiration date in a timezone behind UTC could create a token that never expired. Expiration dates are now interpreted in local time and validated to be in the future.

VS Code Extensions

• #17987 Fixes the Open VSX changelog parser for extensions whose CHANGELOG.md uses release-please-style markdown link headings (e.g. ## [2.4.2](compare-url) (2025-04-17)), major versions at # depth, or human-readable dates such as September 8th 2025. Previously affected extensions like Block Sort and Red Hat Dependency Analytics had missing release dates and dropped entire major-version entries.

• #17613 Fixes VSX gallery API returning empty assets for extensions that do not have those assets.

• #17613 Fixes empty tabs (i.e. Changelog) rendering in Positron or VS Code when used with PPM.

• #17793 Fixes running rspm add on a local VSX extension twice with flag --succeed-on-existing corrupting the extension

• #17820 Fixes OpenVSX extensions marked as “preview” by their author not exposing the preview flag through the VS Code Gallery API.

• #17993 Fixes VSX gallery CORS allow-list missing VS Code client headers (X-Client-Name, X-Client-Commit, X-Client-Version, X-Machine-Id), which prevented Positron’s “Browse additional color themes” picker from loading themes hosted by PPM.

• #17901 Fixes Open VSX extension versions being sorted incorrectly in the Package page and Server API.

• #17872 Fixes the “Verified Publisher” badge not appearing in the package web UI for locally uploaded VS Code extensions.

Packages & Repository

• #17780 Fixes binary download URLs for R packages with a non-default Path: (e.g. Transit) on macOS and Windows, which previously caused installer commands to hit 404 errors. Linux URLs already included the path segment; the same handling now applies to all operating systems.

• #17348 Fixes vulnerability and Open VSX sync not using Manifest.User and Manifest.Password credentials for Basic Authentication.

• #17859 Fixes issue returning stale Bioconductor manifest information.

Authentication & SSO

• #17618 Fixes the logout flow to always redirect to the configured Package Manager landing page rather than honoring an externally supplied redirect target.

Server & Storage

• #17944 Fixes broken support for S3 backed storage with buckets that have Object Lock enabled

CLI & Diagnostics

• #17651 Fixes malformed output from rspm list blocklist-rules when a rule combined deleted-package criteria with other criteria, which previously ran multiple fields together on a single line.

Documentation

• #18039 Fixes the Positron setup wizard instructions: removes a misleading reference to public Posit Package Manager on self-hosted instances, adds a copy-paste settings.json snippet for Positron configuration, and adds Positron-session coverage to the Posit Workbench instructions for both R and Python.

2026.04.2

May 07, 2026

New

• #17628 Open VSX extensions returned by the VS Code Gallery API are now sorted by download count (most popular first) by default, with alphabetical tiebreaking, matching the ordering used by Open VSX.

Fixed

• #17930 Updates in-product license messages to point to current Posit URLs and offer additional sales channels (sales@posit.co or posit.co/schedule-a-call). Fresh-install messages now direct users to posit.co/trial-license for a free 30-day trial. Removes broken legacy reference to apps.rstudio.com/trial-activation/.

• #17916 Fixes VSX gallery API returning extension versions in ascending order instead of descending, which prevented Positron from detecting available extension updates.

• #17901 Fixes VSX extension versions being sorted incorrectly in the packages API and web UI.

• #17899 Fixes Open VSX extension lookup by UUID in the gallery API, which affected searching extensions by ID, installing or updating extensions, and viewing extension details in Positron/VS Code.

• #17637 Fixes extensions deleted upstream from Open VSX continuing to appear in package listings and remain downloadable. Navigating to a deleted or nonexistent extension now shows a “Package not found” message, and deletions remain visible in the activity log.

2026.04.1

April 17, 2026

Fixed

• #17690 Restores the /repos/{repo}/vulns API endpoint that was removed in 2026.04.0. This endpoint returns a list of package vulnerabilities for a repository.

• #17736 Fixes license-manager failing to find its binary on x86_64 RPM distributions (RHEL 9/10, openSUSE 15.6+). A missing architecture detection call caused the installer to select the wrong distro-specific binary at runtime.

• #17743 Fixes the Cloudsmith-based install and upgrade commands in the admin guide. The documented dnf commands used = for version pinning (e.g., dnf install rstudio-pm=2026.04.0), which dnf does not support; the commands now rely on the Cloudsmith repo to serve the correct version. apt and zypper commands continue to use =.

• #16787 Fixes a rare issue where Bioconductor package pages could fail to load, with “pin mismatch” errors in the server log. A sync for one Bioconductor version could overwrite cached data for other Bioconductor versions, causing the same errors fixed in 2026.04.0 to recur. If affected on a previous version, restarting Package Manager will resolve the issue until the next occurrence.

2026.04.0

April 09, 2026

Breaking

• #17043 The /filter/packages API endpoint request body field vulns has been renamed to has_vulns and metadata has been renamed to has_metadata for clarity.

• #17325 CRAN and Bioconductor snapshots will no longer be generated after the 2026.04 release for PPM versions older than 2024.04.0 (CRAN) and 2024.08.0 (Bioconductor). These versions introduced an improved sync format (RSF) that replaced the legacy sync mechanism. Syncing on older PPM versions will continue to work, but no new snapshots will be available, so CRAN and Bioconductor data will become increasingly outdated. Customers on affected versions should upgrade to PPM 2024.08.2 or later to continue receiving updates.

• #16882 Removes the /repos/{repo}/vulns API endpoint. Use the /filter/packages API endpoint with has_vulns: true instead.

• #17128 Fixes an issue where some error messages were logged at INFO level instead of ERROR level, causing messages like INFO Error verifying cluster integrity: node list length differs. to appear as informational.

• #17434 Archived package installation commands now use remotes::install_version() instead of devtools::install_version(), which was deprecated in devtools 2.5.0.

New

VS Code Extensions

• #16554 Adds support for VS Code extensions via Open VSX mirroring or locally uploaded extensions.
  • Quick start: Serving Open VSX Extensions
  • Quick start: Distributing Local VS Code Extensions
  • Open VSX Mirror
  • Local VS Code Extensions

Web Interface

• #17162 Redesigns the package browsing experience by separating the package search and package details into distinct pages:

  • Search page (/repos/:repo/packages): Shows paginated results with Previous/Next navigation.
  • Details page (/repos/:repo/packages/:name/overview): Displays package information with a “Back to List” button to return to search results.
  • Unifies behavior across R, Bioconductor, and Python packages.
  • Improves direct URL sharing and bookmarking.

• #16466 Adds a new Admin Settings area in the web interface for managing administrative features. The initial release includes Token Management, providing a web UI to create, view, filter, sort, and revoke API tokens.

• #16383 Adds a Version History tab to the package details page that displays a timeline of all versions across sources and snapshots in a repo. This helps users understand when each version became available and which snapshot URL to use for reproducible environments.

• #16972 The Sign In button is now visible whenever authentication is configured (SSO or API tokens), even if no repositories require authentication. This allows users to sign in for the Token Management UI without needing an authenticated repository.

• #17222 Adds Positron IDE as an environment option on the Setup page for both R and Python repositories, with instructions for configuring package sources via Positron settings and environment variables.

Authentication & SSO

• #16641 Adds a new RequireAuthForUI configuration option for OpenID Connect that requires SSO authentication for all web UI access. When enabled, unauthenticated users are automatically redirected to the SSO login page. Repository access for package installation and Server API endpoints are not affected.

• #16641 Users without configured scope mappings can now log in via SSO. Previously, users with no matching GroupToScopeMapping or RoleToScopeMapping entries received an error. Now they can authenticate and access unauthenticated repositories, which supports the new RequireAuthForUI feature.

• #16818 Adds a new UseUserInfo configuration option for OpenID Connect that fetches additional claims from the OIDC UserInfo endpoint and merges them with ID token claims. This supports identity providers that put groups or roles in the UserInfo response rather than the ID token (e.g., Azure AD, Okta).

Packages & Repository

• #15552 Adds support for the PEP 639 License-Expression metadata field for Python packages. When a package specifies a valid SPDX license expression (e.g., “MIT OR Apache-2.0”), it is now parsed and displayed as the package license, taking priority over legacy classifier-based license detection. This applies only to package versions released on or after February 25, 2026.

• #16257 Adds support for serving precompiled binary packages for Debian 13 (Trixie).

• #16649 Multiple newlines, tabs, and whitespaces are now being properly removed from the PACKAGES file.

• #16792 New supported distributions and R versions are now synced every 6 hours instead of every 24 hours.

MCP Tools

• Split the get_status MCP tool into three focused tools for better discoverability: get_server_info (version, feature flags, auth config), get_supported_distros (binary platforms, R versions), and get_bioc_versions (Bioconductor versions with R mappings and CRAN snapshots).

• #16882 Adds a new filter_packages MCP tool that allows AI assistants to filter packages from a repository or source based on criteria like vulnerabilities, custom metadata, and version constraints.

• #17079 Adds a new get_package_releases MCP tool that fetches lists of Python package releases for a specific package name and repository.

• #17080 Adds Python package documentation support to the get_package_docs MCP tool, allowing it to retrieve and display documentation for Python packages in addition to R and Bioconductor packages.

• #17082 The get_vulns_list MCP tool now supports pagination with limit and page parameters, and returns a total_count field for easier navigation of large result sets.

• #17084 Adds a new get_repo_licenses MCP tool that aggregates license information across a repository, providing a summary of packages grouped by license with SPDX identifier standardization for R, Bioconductor, and Python packages.

• #17290 The MCP server now operates in stateless mode, simplifying client integration by not requiring session persistence between requests.

Documentation

• #16988 Updates installation documentation to recommend the Posit Package Repository as the primary installation and upgrade method, which automatically handles GPG key management and provides a simpler set of steps.

Fixed

Server & Startup

• #17506 Fixes failed or partially downloaded packages from being marked as complete.

• #16928 Fixes an intermittent startup error in cluster configurations where concurrent syncs could fail with duplicate key value violates unique constraint "server_settings_pkey" on the SYSREQS_LATEST_CHECKSUM setting.

• #16835 Fixes various errors that could occur when starting Package Manager for the first time in a cluster configuration, such as:

  Error running services: Error migrating ... ERROR: duplicate key value violates unique constraint "server_settings_pkey" (SQLSTATE 23505)

• #16862 #17157 Fixes an issue where Package Manager could hang indefinitely on startup when refreshing supported distributions, particularly when an error occurred during the startup process. In previous releases, this can be worked around by adding the following to your configuration file and restarting the server:

  [Distros]
  AutoUpdate = false

• #16689 Fixes a rare issue where Package Manager could hang when syncing vulnerabilities.

• #16713 The /__ping__ health check endpoint now returns HTTP 200 even when the license is expired, allowing Kubernetes readiness probes to succeed so users can access the web UI and see the license expiration notice.

• #16714 Posit Package Manager now starts successfully with [OpenIDConnect] or [IdentityFederation] configuration when the license does not permit OpenID Connect. The settings are ignored with a warning instead of causing startup failure.

• #16341 Package Manager can now use an Azure service principal to authenticate to PostgreSQL.

Web Interface

• #17583 Fixes a 404 “XSRF mismatch” error when viewing images in R package READMEs while signed in via SSO.

• #16317 Fixes an issue where refreshing the Setup page could reset the selected binary distribution to “source” instead of preserving the user’s selection.

• #16787 Fixes persistent “pin mismatch” errors when viewing Bioconductor package pages. A cache key mismatch caused RSF updates for Bioconductor sources to be silently skipped, leaving stale graph data until server restart.

API & Database

• #17012 Fixes a crash in the package filter API when Server.UsageDataEnabled is set to false. The API now returns a clear error message asking users to either set omit_downloads to true or enable usage data.

• #17164 Fixes a database migration failure when upgrading from PPM 2023.12 or earlier if the database contained very large queue failure addresses. The migration now uses a PostgreSQL hash index which has no size limit.

CLI & Diagnostics

• #17155 Fixes the diagnostics script not including config files from /etc/rstudio-pm/ due to a hardcoded relative path.

• #16764 The rspm encrypt command now correctly prints its input prompt when run interactively: Encryption: Enter the plain text value below..

• #16554 Adds rspm CLI support for VS Code extensions:

  • rspm create repo --type=vsx to create VS Code extension repositories.
  • rspm create source --type=openvsx and --type=local-vsx to create mirrored or local extension sources.
  • rspm sync --type=openvsx to sync extensions from the Open VSX registry.
  • rspm add --source=<local-vsx source> --path=<file.vsix> to upload .vsix files to a local source.
  • rspm remove --name=<namespace.name>@<version> to remove extensions from a local source.
  • rspm list packages, rspm subscribe, rspm unsubscribe, and rspm info all support the new VSX source and repo types.

Documentation

• #16994 Updates documentation and CLI examples to use --authenticated=true instead of --authenticated when enabling repository authentication, making it clearer that --authenticated=false can be used to disable authentication.

• #14007 Documents missing Package Service Log properties for PyPI downloads: pypi_file class, sha256 field, and filename field.

2025.12.0

December 23, 2025

Breaking

• #14714 Disables StorageAudit configuration by default. Storage auditing can experience performance issues when used with certain storage systems due to the network overhead of file system operations and is only relevant when using local storage (not NFS or S3). The config can be reenabled via:

  [StorageAudit]
  Enabled = true

• #16698 PyPI simple index pages are now generated with relative paths by default instead of using the configured Server.Address. These pages only require the Server.Address setting if running Package Manager behind a reverse proxy at a sub-directory path (e.g. https://proxy.com/packagemanager/). No action is required in most cases. If using a reverse proxy, ensure it passes the standard X-Forwarded-* proxy headers and review the proxy documentation to ensure your deployment is configured properly.

New

• #16460 Adds support for a Model Context Protocol (MCP) server, providing AI assistants a more reliable way to interact with package repositories programmatically. See the MCP Server documentation for more information.

• #16390 Package Manager can now be installed for the ARM64 architecture on Ubuntu 24.04 (Noble) or Red Hat Enterprise Linux 10 (RHEL 10). The standalone rspm CLI tool and offline downloader are also available for ARM64 on any Linux distribution.

• #16337 Adds support for OAuth2 federated credentials for Git builders. This provides modern, secure authentication using short-lived access tokens for Azure DevOps and Bitbucket repositories. For Azure DevOps, supports both client credentials flow using client secrets and federated identity using OIDC tokens with Microsoft Entra ID. For Bitbucket, supports client credentials flow using OAuth consumers. See the Git Credentials documentation for setup instructions.

• #16364 Adds support for GitHub App credentials for Git builders. This provides an alternative to SSH keys and HTTPS credentials (Personal Access Tokens) for authenticating to GitHub repositories. GitHub Apps offer enhanced security through short-lived tokens, more granular permissions, higher rate limits, and better audit trails compared to traditional SSH keys or PATs. See the GitHub App Credentials documentation for setup instructions.

• #16721 Adds support for SLES 15 SP7.

• #16628 Added instructions for using uv to install Python packages from Posit Package Manager in the Setup documentation.

• #16314 rspm list tokens now outputs the user value.

• #16370 Improves PyPI simple package HTML generation performance by replacing file-based caching with ristretto in-memory caching and implementing streaming-based content delivery. This reduces disk usage in the pypi storage class and improves response times for PyPI package index requests.

• #16507 Adds support to authenticate through the Posit Team Snowflake Native App with rspm login and rspm login sso using a new --snowflake-connection flag.

• #16262 Adds dark mode toggle to PPM header and theme.

Fixed

• #14822 Homepage is now displayed in the web UI for Python packages that specify their homepage using the Project-URL field.

• #16343 rspm list now checks for invalid subcommands.

• #16361 Improves detection at startup of when user namespace sandboxing is disabled for Git package builds.

• #16483 Fixes an issue where Package Manager can’t add a package to a curated CRAN source if it was fully archived prior to approximately October 2017.

• #16429 Fixes an issue where Package Manager would return archived packages in the archive.rds file from a lower priority source in a repository.

• #16732 Fixes an issue where R package binaries could not be served in rare cases. For example, this prevented binaries from being served for Rcpp 1.1.0 and any directly dependent packages on December 8, 2025.

2025.09.2

November 3, 2025

Fixed

• #16514 Fixes an issue where Package Manager has high CPU utilization when the product check configuration is enabled.

• #16415 Fixes several issues related to blocklist rules created with --min-severity setting when using Postgres:

  • Fixes an issue where creating and listing blocklist rules did not display --min-severity setting when using Postgres.
  • Fixes an issue where blocklist rules created with any --min-severity value blocked all packages and versions when using Postgres.
  • Fixes an issue where blocklist rules could not set --min-severity to a non-x.0 decimal value when using Postgres (i.e could create with 1.0 but not 1.1).
  • Fixes an issue where blocklist rules setting --min-severity did not properly count x.y and x.z as unique when using Postgres (i.e 1.1 and 1.2 would be treated as the same).

2025.09.0

September 10, 2025

Breaking

• #15747 Updates rspm_ Prometheus metric prefix to ppm_ and binary_ Prometheus metric prefix to ppm.binary_

• #15396 Ubuntu 20.04 (Focal) has reached vendor end of support and is no longer supported.

• #16039 The --user flag is now required when using rspm create token. This flag associates the token with a user or application name for better audit logging.

New

• #15767 Adds support for single sign-on (SSO) authentication via OpenID Connect (OIDC), enabling integration with identity providers like Okta and Microsoft Entra ID. Advanced customers can now use SSO for user and group authentication, mapping to all Package Manager authorization scopes. SSO login is available via web browser, the Package Manager CLI, and tools like pip and uv for Python package installation. Client support for R package installation will be coming soon. See the SSO Authentication documentation to get started.

• #14961 Portable Linux R binary packages are now available in public preview. These packages bundle system library dependencies for easier and more reproducible installation across many Linux distributions. To try them out, visit the Setup page, select manylinux glibc 2.28+ (preview) from the Linux Distribution dropdown, and follow the instructions to update your repository URL in R. For more information, see the documentation on Portable Linux Binary Packages.

• #15612 CRAN binary packages are now available for select ARM64 Linux distributions (Ubuntu 24.04, RHEL 9, RHEL 10, and manylinux 2.28+) and R versions 4.1 through 4.5.

• #15613 Adds a new R repository URL format for Linux that supports declaring the full package environment (distribution, architecture, and R version) as part of the repository URL itself: /bin/linux/<distro>-<arch>/<version>. For example, the URL to retrieve binary packages for Ubuntu 24.04 (Noble), on ARM64 architecture, for R 4.5 would be https://ppm-server/cran/latest/bin/linux/noble-aarch64/4.5. For the x86_64 architecture, the URL would be https://ppm-server/cran/latest/bin/linux/noble-x86_64/4.5.

• #15975 Server.HTTPCacheControl default value has been set to max-age=3600.

• #15715 Adds Server.HTTPCacheControl header for package downloads to better support CLI tools like uv.

• #15335 Adds --min-severity and --block-unscored flags to rspm create blocklist-rule and rspm edit blocklist-rule to allow package blocking by CVSS score.

• #15640 CVSS scores, if available, are now displayed in the vulnerability list and vulnerability info panel.

• #15908 Adds a product check request that pings a Posit server when Package Manager is set up and using an active or trial license. This check helps us proactively support customers by confirming successful installation. This is controlled by the Server.ProductCheck configuration setting, default true. Server.ProductCheckFrequency configures how often this check is sent out, default 24h.

• #15580 Adds in-memory caching for package download counts. This avoids cluttering the cache directory with files matching the *_DOWNLOAD_COUNTS_QUERY_* pattern.

• #15585 When RetainFetchedPackages = no is configured in the Server, CRAN, Bioconductor, or PyPI sections, Package Manager avoids caching package metadata loaded on demand from the Posit Package Service. This is also the new default behavior for air-gapped environments. If you are using S3 for shared storage, consider setting Server.RetainFetchedPackages = no to reduce S3 usage/traffic.

• #11806 Usage stats can be sorted by count via keyboard using tab/enter to navigate and toggle.

• #15336 Alert banner is now easier to read.

• #16012 Adds rspm login sso command for authenticating in the CLI with SSO.

• #16012 Adds rspm login command for authenticating in the CLI with an API token.

• #15723 Adds support for Red Hat Enterprise Linux 10 (RHEL 10).

Fixed

• #7678 Fixes an issue where packages with the same name but different casing (e.g., mypackage and MyPackage) could result in duplicate package versions being shown in the UI and CLI, and prevent package details from appearing in the UI.

• #15416 Fixes an issue where a snapshot synchronization race could result in caching outdated information.

• #15630 Fixes an issue where python signature files were deleted from the cache, preventing python packages from being downloaded.

• #15564 Suppresses user related (4XX) API errors in the server log.

• #15564 Fixes an issue with displaying Git package details in the UI in rare cases.

• #15806 Fixes an issue with panics occurring when encountering a filesystem error when calling the create packages API endpoint

• #15824 Fixes an issue with the rspm edit repo command not checking for special characters in a repo name when editing a repo.

• #15187 Fixes an issue with high memory usage associated with many concurrent requests for Python packages from Curated PyPI sources.

• #15618 The run-diagnostics script no longer requires running as the root user.

• #15860 Uses the configured Server.TempDir (which typically defaults to /tmp) when bind mounting the temp directory for sandboxing R processes.

• #11880 Fixes incorrect binary URL generation for packages with special paths.

• #16063 Fixes an issue where vulnerabilities were not reported for recent package versions in some cases.

• #16130 Fixes an issue where R package system dependency information was not being updated after the initial sync. System dependencies are now properly updated during CRAN or Bioconductor synchronization. This issue affected both the “Install System Prerequisites” feature in the web UI and the rspm list requirements command in the CLI. For older versions of Package Manager, you can force a one-time update by running the rspm evict --type=clear command as a temporary workaround.

• #16108 Fixes an issue where Package Manager served the wrong package version when installing archived CRAN binary packages older than approximately October 2017.

• #16196 Fixes an issue where migrations from SQLite to Postgres could fail due to sorting inconsistencies during the verification step.

API Changes

• #16059 The /filter/packages API endpoint now allows anonymous access when requesting information for an unauthenticated repo. Requests for information for a source or requests for an authenticated repo still require authentication.

• #16059, #16115 The /filter/packages API endpoint now supports three new boolean parameters:

  • #16059 Use omit_dependencies to omit package dependency information for better performance.
  • #16059 Use omit_downloads to omit package download statistics.
  • #16115 Use omit_package_details with R and Bioconductor repos or sources to omit available_versions output and avoid additional lookups for better performance. Note that using omit_package_details is only supported for adhoc requests where you supply a list of package names. Note also that version constraint ranges (e.g., plumber<1.0.0) may result in listing only package versions that appear in PPM snapshots since October 2017; older archived package versions may not be listed. We recommend using omit_package_details only with version equality constraints (plumber==0.4.2) or no version constraints (plumber).

2025.04.4

July 7, 2025

Fixed

• #15918 Correctly ignores missing dependencies in Curated CRAN sources.

• #15918, #15937 Fixes issues where package graphs connections could remain open permanently.

• #15914 Fixes an issue where the CRAN manifest reader could remain open permanently during an rspm update command without a --snapshot parameter.

• #15910 Fixes an issue where package graph connections remained open too long during requests involving R package binaries.

• Fixes a few issues where a single request required more than one database connection at a time:

  • #15937 Requests for Curated CRAN/PyPI sources could require more than one database connection at a time.
  • #15937 The URL creation API used by the Package Manager Setup page calendar required more than one database connection at a time.
  • #15937 Migrations of older Curated CRAN sources could require more than one database connection at a time.

• #15937 Fixes an issue where requests for documentation or for the REST API were using a database connection unnecessarily.

• #15937 Fixes an issue where requests for repos involving both Local and Curated CRAN/PyPI sources could hang when too many database connections were in use.

• #15937 Fixes an issue where requests for repos involving both Bioconductor and Curated CRAN sources could hang when too many database connections were in use.

• #15937 Fixes a bug with creating a custom PostgreSQL sorting collation on startup. This affected installations using PostgreSQL with a single database and separate schemas for main and metrics data.

2025.04.2

May 30, 2025

Fixed

• #15716 Fixes an issue with dependency graph caching that could result in serving incorrect Curated CRAN and CRAN Snapshot package binaries.

Deprecated/Removed

• #15716 Deprecates the Server.InMemoryPackageGraphSize and Graph.EvictionInterval settings. These settings will be removed in a future release.

2025.04.0

April 10, 2025

Breaking

• #15486 The /filter/packages API endpoint now requires a global:admin, metadata:admin, or sources:write token scope for source based requests.

• #14260 Curated CRAN sources now include dependencies for their suggested dependencies. Previously, there were some scenarios where Curated CRAN sources included suggested dependencies without including the dependencies of those packages.

New

• #14954 Added support for authenticated repositories via Basic HTTP authentication. This feature allows you to create repositories that restrict access to users with an API token. See the Authenticated Repositories to get started.

• #14193 Automatically rotate the encryption key and encrypted values with rspm encrypt rotate.

• #15345 Added a --no-archived flag for creating Curated CRAN and CRAN Snapshot sources without archived packages.

• #13345 Posit Package Manager documentation is now produced using Quarto.

• #15223 The Server API Guide now automatically utilizes the API token from your web UI sign-in.

• Updated to Golang 1.24.

• #14196 Enabled operational metrics by default on port 2112, with the option to disable them by setting Metrics.Enabled = false.

• #15365 Updated the R configuration steps for Linux binary packages when using the curl download method. Added curl flags to improve output, error handling, and support Package Manager instances using Manifest.AllowRedirect = true. If you are using curl on Linux, see Configuring the R User Agent Header for updated instructions.

• #14260 Updated the way Package Manager calculates package dependency graphs for better performance, significantly reduced caching, and to avoid thrashing.

• #14260 Adds first-class support for Enhances and RevEnhances when calculating dependencies. For example:

  • Package eemR from CRAN should now include a link in Reverse Enhances in the Web UI to albatross. Previously, no Reverse Enhances links were shown.
  • Package albatross from CRAN in the Web UI should include an Enhances link to eemR that is clickable. Previously, forward Enhances links were not clickable in the Web UI.

Fixed

• #14820, #15437 Added core metadata 2.3 and 2.4 support for Python packages. This fixes an error with adding Git or local Python packages: path may not point to a valid Python package: metadata is missing required fields.

  • If you are on Package Manager 2024.11.0 or earlier and cannot upgrade, you can temporarily work around this by pinning the build backend of your package to the latest version that uses core metadata 2.2 or earlier. These versions include:
    • setuptools==76.1.0
    • poetry-core==1.9.1
    • hatchling==1.21.1
  • If you cannot modify the package or upgrade Package Manager, please contact Posit support for assistance.

• #15119 API tokens can now be used as Authorization Basic headers with the __token__ user.

• #14846 Bioconductor.SyncSchedule config setting removed.

• #14907 Display better error when there are conflicting values for HTTP.Listen and HTTPS.Listen.

• #14848 Fixed an issue where the Activity Log’s Package Versions header did not span all of its columns.

• #12399 Fixed an issue with rspm CLI where a confusing error was displayed with an invalid license.

• #14765 The Bioconductor repository URL on the Setup page no longer includes an unused /__linux__/ segment when a Linux distribution has been selected.

• #5218 The system requirements API and CLI were updated to explicitly return an error when a request is made for a Python repository.

• #14885 Makes the dependency lines included in PACKAGES and PACKAGES.rds more consistent.

• #14899 Fixes an issue where the /filter/packages API missed including some dependencies for archived R packages.

• #14928 Fixes an issue where legacy Curated CRAN sources with many updates were very slow to migrate.

• #15128 Fixes an issue where requests for archived R package binaries from Curated CRAN sources resulted in source packages even when precompiled package binaries were available.

• #15073 Fixes an issue where rspm test blocklist-rules command did not report R vulnerabilities for archived versions based on the repository name.

• #15314 Fixes an issue where migrating Curated CRAN sources from previous versions could fail with an error ending with “error getting alias for macro transaction <number>: sql: no rows in result set”.

• #15269 Fixes an issue that made all Bioconductor versions available even when Bioconductor.EnabledVersions was configured to restrict available versions.

Deprecated/Removed

• #15485 The metadata:read token scope has been deprecated. Existing tokens with this scope can continue being used, but new tokens cannot use this scope. New tokens should use the repos:read scope instead.

• #15450 Deprecates support for PyPI updates for Posit Package Manager versions prior to 2023.04.0. If you are using a Package Manager version prior to 2023.04.0, updates for PyPI repositories will soon be disabled.

• #15244 openSUSE 15.5 and SLES 15 SP5 have reached vendor end of support and are no longer supported.

• #15503 The precompiled binary packages for Debian 11 (Bullseye) are no longer updated as it has reached vendor end of support.

API Changes

• The following API methods were removed:

  • #15156 /sources/:source/vulns
  • #15156 /sources/:source/vulns/:package

• The following API methods now require authentication:

  • #15156 /sources
  • #15156 /sources/:source/packages

• The following API paths changed:

• #15156 /sources/:source/packages/:key/releases moved to /repos/:repo/packages/:key/releases

• #15156 /sources/:source/transactions moved to /repos/:repo/sources/:source/transactions

• #15156 /sources/:source/snapshots/:key/packages moved to /repos/:repo/sources/:source/snapshots/:key/packages

• #15154 All API methods beginning with /repos/:repo that support anonymous access now support optional authentication with API tokens for repos that require authentication.

• #15156 The /filter/packages API now supports authentication with API tokens with repos:read permissions when the repo request parameter is provided.

2024.11.0

December 4, 2024

Breaking

• #13652 CentOS/RHEL 7 has reached vendor end of support and is no longer supported.

• #14307 Changed swagger definitions and response types for creating and listing repos and sources, to avoid exposing internal struct types.

• #14187 The configuration option HTTP.Listen will now default to :4242. Set HTTP.Listen to an empty value to disable HTTP server connections.

• #13651 Deprecate the [Server].EncryptionKeyPath option in favor of storing the encryption key on the persistent storage location (s3 or file). An existing key will be migrated to the [Storage].Persistent location. Remove the [Server].EncryptionKeyPath setting after the key has been migrated to avoid warnings in the startup logs.

New

• #14518 Introduces the first of a new set of features called Metadata Services, which allow you to enrich Package Manager’s built-in package information with your own information, like internal package scores, approval status, or even links to your own supplemental documentation. For more information on how to use custom metadata, refer to the documentation.

• #14026 Adds support for openSUSE 15.6 and SLES 15 SP6.

• #14320 Adds a command to the Bioconductor setup page to set the R_BIOC_VERSION environment variable for better reproducibility. This prevents BiocManager from automatically upgrading to a new Bioconductor version as soon as it’s released.

• #7812 Our installation documentation now recommends using apt instead of gdebi to install Package Manager.

• #14213 Python Git builders now build binary distributions (wheels) for Python packages if possible, in addition to source distributions. This may help prevent package installation failures using newer versions of pip that use build isolation, and speed up installations for packages with compiled code.

• #14404 Document the rspm evict command types for more clear usage.

• #14430 Adds new rspm encrypt generate command to create an encryption key manually before starting Package Manager.

• #14431 Document how to edit the rstudio-pm.service configuration.

• #14472 Adds a new PACKAGEMANAGER_PROXY_TOKEN environment variable for the CLI to set the Authorization and X-PPM-Authorization headers accordingly for proxied environments.

• #14560 Adds the ability create blocklist rules based on a repository.

• #3856 The UI now displays a single entry with a version selector when multiple current versions of a package exist in CRAN.

• #13651 Handle generating and storing the encryption key automatically in the persistent storage location. The new location is /persistent/encryption/rstudio-pm.key at the [Storage].Persistent location. The original key remains backed up on the disk at the same location with the name rstudio-pm.key.bak.<timestamp_of_migration>.

• #14816 Adds retry logic when connecting to a Postgres database to better handle failover scenarios.

• #14403 Adds a Manifest.AllowRedirect setting to support 307 redirects to the underlying package repositories. This enables the ability for users to download packages directly from the Manifest.URL location without passing through Package Manager and caching locally.

  • This can both significantly improve package serving performance and reduce storage usage.
  • Note: the end user’s system needs outbound internet access to the Manifest.URL location (by default this is the Posit Package Service, http://rspm-sync.rstudio.com). This is not always feasible depending on the network configuration.
  • Note: redirects are supported by both R’s install.packages() and the Python’s pip by default, but if using a non-default download method in R such as curl, you will have to add the download options to follow redirects for that particular method.

• #14752 The run-diagnostics script now includes the output of the git-builds command.

• #14488 Updates the recommended system requirements for Package Manager to 4 CPU cores, 16 GB memory, and at least 500 GB of storage. The previously recommended system requirements are now the minimum system requirements.

  • The AWS reference architecture configurations have been updated to reflect the new recommended system requirements.

• Updates the Reference Architectures documentation with new architectures for Microsoft Azure and more:

  • #14250 Adds the Azure * Single Server architecture.
  • #14612 Adds the Azure * Load Balanced architecture.
  • #14251 Adds the Azure * Kubernetes architecture.
  • #14270 Adds Generic Architectures for running Package Manager in a general architecture.
  • #14451 Adds Architecture FAQs for frequently asked questions about the reference architectures.
  • #14427 Adds recommendations for using Azure Files as NFS file storage.

• Updated to Golang 1.23.3.

Fixed

• #14219 Fixed an issue where Git-based packages did not load correctly after migrating to a Postgres DB.

  • Please contact Posit support if you see messages like this in your server log after migrating to Postgres using an older Package Manager version: Unable to set Git Builder URL for Git package: sql: no rows in result set.

• #14211 Fixed an issue where --succeed-on-existing flag for rspm create git-builder did not work.

• #14192 Fixed an issue where excessive blank space could appear on the Usage Stats page in certain browsers like Chrome.

• #14273 Fixed an issue that prevented retrieving archived packages from CRAN Snapshot sources migrated from Package Manager 2023.12 or earlier.

• #14291 Fixed an issue with the R Package page loading slowly for packages with a large number of dependencies.

• #14292 Fixed an issue with serving responses for missing Python packages when using S3 file storage. This could cause tools like uv to fail when installing packages in some cases.

• #14292 Fixed an issue with missing Activity Log messages for curated CRAN sources when using S3 file storage.

• #14321 Fixed an issue with rspm CLI error messages not appearing in some cases.

• #14300 Fixed an issue that could cause binary package serving to fail when using a proxy or third-party integration, like Artifactory, in very rare cases.

• #14390 Increases timeout to prevent intermittent “timeout waiting for macro transaction to open” errors.

• #14339 Fixed an issue where the Postgres.UsageDataURL would default to the Postgres.URL, but the Postgres.UsageDataPassword would need to be configured separately.

• #14420 Fixed an issue where the Database.Provider = postgres setting wasn’t accounting for case sensitivity resulting in errors that the commands are only available when using a PostgreSQL database.

• #14254 CRAN snapshot dates now backdate to the selected Bioconductor date on the Setup page.

• #14381 Fixed an issue with Package Manager hanging on startup if Server.TempDir was set to a directory mounted as noexec. If affected, the server log would have contained a message like this: Error: Unable to run an executable program within the Server.TempDir='/tmp'; this directory may be mounted 'noexec'.

• #13132 Fixed an issue where the CRAN repository package count could be incorrect.

• #14475 Fixed an issue where curated CRAN requirements containing a dash ‘-’ resulted in a failure.

• #14485 Fixed an issue where an error during package updates could cause temporary files to accrue.

• #14547 Broad encryption key file permissions now log a warning rather than prevent start-up.

• #14733 Fixed an issue where the vulnerabilities endpoints were returning packages that were not available in the repository or source.

• #14560 Fixed an issue where the PyPI simple package page could incorrectly reference the wrong repository.

• #14503 Fixed a confusing rspm error where an invalid character ... looking for beginning of value. This will now output the body from the failed request.

• #14690 Fixed an issue where the Postgres.UsageDataPassword was set, but the Postgres.UsageDataURL would not use the default Postgres.URL.

• #14624 Fixed an issue where autosyncing Bioconductor would fail due to a missing version number.

• #14628 Fixed an issue where a failed package update could get cached and require a server restart to recover.

• #14606 Fixed S3Storage.Prefix handling by automatically stripping all leading and trailing slashes.

• #14630 Fixed an issue where disabled vulnerabilities flag was not applied correctly.

• #14726 Fixed an issue where Bioconductor packages with the same name but different versions could cache metadata incorrectly across Bioconductor versions.

• #14845 Fixed an issue where the online, offline, and cluster online/offline commands failed when Package Manager was configured for PostgreSQL with a separate Postgres.Password setting.

2024.08.2

September 20, 2024

Fixed

• #14408 Fixed a migration issue involving Bioconductor usage with Package Manager versions prior to 2021.09.

2024.08.0

August 09, 2024

Breaking

• #13962 Bioconductor sources can no longer be created with the rspm create source command. Individual Bioconductor sources have been replaced with a single Bioconductor source that provides data for all Bioconductor versions. See the Quick Start guide for more information.

• #13817 [Debug].Log has been deprecated and disabled, along with debug regions. See [Logging].SystemLogLevel for debug logging.

• #13858 Systemd service file has been simplified due to logging changes. tee is no longer used to redirect logs to log file and PID file no longer used. See [Logging] section for logging configs.

• #13817 rspm config debug logger has been updated. It is now rspm config log --level=[level] to set various logger levels.

• #13805 The [Authentication].APITokenAuth setting is now enabled by default.

• #13683 API endpoints now expect repository and source names instead of IDs. IDs are still supported for backward compatibility, but this may change in a future release. Using IDs instead of names may result in inconsistent output if any sources or repositories use numeric names.

• #13404 Deprecates using rspm add to add packages to Curated CRAN sources. Use rspm update to add packages to Curated CRAN sources.

• #13518 openSUSE 15.4 and SLES 15 SP4 have reached vendor end of support and are no longer supported.

• #13681 The Swagger API documentation version will now match the application server version.

• #13674 The Id in the transactions API will now be null for CRAN, PyPI, and other mirrored sources instead of 0.

• #13701 Integers are no longer allowed as source or repository names.

• #13933 New repository and source names may only contain the characters a-z, A-Z, 0-9, and ., ~, -, _.

• #14010 The rspm url create command now requires the --date flag.

New

• #13817 [Logging] section has been added to configure the system log output, format, and level.

• #13643 Postgres installations no longer require a separate database for the usage data. The [Postgres].UsageDataURL field will now default to the configured [Postgres].URL.

• #9905 Adds a new notification banner and prometheus metric for the number of days left until the product version is no longer supported. See the support configuration settings to tweak these options.

• #13682 The Server API is now considered stable and generally available. While endpoints are still subject to change, breaking changes will be documented.

• #13767 Adds a new flag option rspm evict --type=clear for immediate cache eviction.

• #13799 Adds a new rspm bootstrap command for creating keypairs, and generating an admin token for remote management.

• #13778 The entire admin CLI is now available for use remotely, with the exception of the offline, online and cluster commands. API tokens can be generated with the new global:admin scope to allow full access to the CLI. See the Remote Use documentation for more details.

• The following commands can now be used remotely with the sources:write API token scope:

  • #13592, #13779 rspm update and rspm add on curated CRAN, CRAN snapshot, and curated PyPI sources.
  • #13780 rspm import to import a Git credential that can be used for any Git source.
  • #13781 rspm remove to remove packages from a source.

• #13954 Adds the rspm verify command to verify a connection to the server.

• #13599 Adds the AppArmor profile for Ubuntu 24.04 and later versions, enabling the use of user namespace sandboxing for Git package builds.

• #13947 Bioconductor sources now fully support date-based snapshots. Use the snapshot calendar on the Setup page to get a frozen URL for any Bioconductor packages. Bioconductor repos may now optionally include a latest or snapshot URL segment.

• #13222 Adds support for Ubuntu 24.04 (Noble).

• #8076 Adds the OS Type field to the R package Overview page in the UI for packages that specify an OS type.

• Updated to Go 1.22.6.

Fixed

• #13633 Fixed an issue where the PyPI repository view would incorrectly show some popular packages. The view will also now sort popular packages using 30 day rollups instead of 90 days.

• #13545 Fixed an issue where Python signature files were being recorded as package downloads.

• #13699 Retry Git clones when building Git packages in the case of transient download issues.

• #13721 Fixed an issue that was causing reloads of the Bioconductor activity page to navigate to the error page.

• #13656, #13724, #13750 Fixed several issues with missing messages when running the rspm update command.

• #13621 Fixed an issue where changes to PyPI packages in an offline environment would not be reflected in PyPI repositories when installing packages from historical date snapshots.

• #13692 Fixed an API issue with unbounded memory usage when enumerating packages.

• #13692 Fixed an API memory issue to remove a potential Denial-of-Service (DoS) vulnerability.

• #13728 Fixed an issue where multiple Git builds with matching checksums would sometimes fail.

• #13557 Python and R repositories with no snapshots will no longer try and display a calendar.

• #13852 Fixed a bug with the rspm_license_days_left metric returning the days left for a trial instead of the activated license.

• #13880 Fixed an issue where Git builds would intermittently fail due to missing remote references.

• #13886 Fixed an issue with retrieving data from empty Curated CRAN sources.

• #14009 Adds back the Needs Compilation and Dependency columns to the rspm update for curated CRAN sources.

• #14039 Fixed an issue where Postgres returned an unexpected EOF resulting in a fatal shutdown.

• #13739 Fixed an issue with displaying all results for certain searches.

• #14069 Fixed a Git builder issue that would cause the error sql: Scan error on column index 10, name "url": converting NULL to string is unsupported.

• #14099 Fixed an issue with loading R package binaries for archived packages.

• #14118 Fixed an issue where the distribution selectors displayed in the UI had different values.

• #7179 Fixed an issue with loading R package binaries for archived packages from CRAN Snapshot sources.

• #14121 Fixed an issue with the UI where archived source file URLs were invalid for packages with paths such as 4.5.0/Recommended.

2024.04.4

June 26, 2024

Fixed

• #13938 Fixed an issue with migrating Curated CRAN sources when using a PostgreSQL database.

2024.04.2

June 14, 2024

New

• #13648 Adds an index to the cache_objects table for more efficient cache evictions.

Fixed

• #13747 Fixed an issue with migrating Curated CRAN sources that were created prior to Package Manager 1.2.0.

2024.04.0

May 6, 2024

Breaking

• Air-gapped customers are required to redownload the CRAN data after upgrading before syncing the CRAN source. See the Admin Guide for more information.

• The offline downloader version must now correspond with the Package Manager version.

• #12664 Removes support for populating the database with information on cached objects when upgrading from versions prior to 1.1.2. If you are upgrading from a version prior to 1.1.2, recently used cached objects may be evicted, but will be automatically recreated on demand.

• Removes support for the id query parameter from all API endpoints. Packages should be referenced only by name.

• The /packages/:id/files/:path API address has changed to /repos/:id/packages/:name/files/:path and requires a package name instead of an ID.

• The /packages/:id/readme API address has changed to /repos/:id/packages/:name/readme and requires a package name instead of an ID.

• #12880 When updating a Git builder’s URL, specifying the branch is also required to ensure its existence.

• #13182 Integrations with Artifactory must add the new **/rsf/** inclusion/exclusion rules to the repositories.

• #13750 Updating the snapshot date of an empty curated CRAN source is no longer possible.

New

• PyPI repositories can now be used in air-gapped or offline environments. Rather than downloading all of PyPI, you’ll define your own subset of packages you want to make available offline. See the Air-Gapped Package Manager documentation for instructions on how to set up an offline PyPI repository.

• #13114 Adds automatic CRAN synchronization. Package Manager will synchronize the CRAN source on demand and check for CRAN updates every 10 minutes.

• #13114 Major updates to the CRAN source. CRAN data is no longer stored in the database, which significantly reduces sync time and increases performance. If you are already using a CRAN source, you can take advantage of these improvements by running rspm sync --type=cran immediately after upgrading.

• #12884 By default, new created Curated CRAN sources now use a more permissive package version snapshot behavior. You can still create Curated CRAN sources using the previous behavior by using the --strict option when creating the source. See the Admin Guide for more details.

• #12884 rspm update now supports specifying a requirements.txt file with the --file-in flag for Curated CRAN sources.

• #12884 New Curated CRAN sources can now filter individual packages using version constraints. This does not apply to Curated CRAN sources created before this release.

• #12884 New Curated CRAN sources can now have their snapshots updated backwards in time. This does not apply to Curated CRAN sources created before this release.

• rspm create source now supports a --include flag which determines which types of related packages are included in the source.

• #12991, #13260, #13307 Python autodetection will now attempt to pick the highest available version of python or python3 bin in $PATH or /opt/python/* that has build and virtualenv modules. If no such version is found, it defaults to the highest version available.

• #4639 R PACKAGES and PACKAGES.rds responses for package binary lists include new fields.

  • #4639 For local and Git package binaries, the new Sha256Hash field records the SHA256 hash for the file.
  • #4639 For CRAN package binaries, the new Hash field can be used to determine when a package binary is updated. This field should not be used to verify file integrity.

• #12534 Package Manager will now switch its built-in encryption to use the AES-256-GCM algorithm when the Server.UseFIPSEncryption setting is enabled. This algorithm is an Approved Security Function under Federal Information Processing Standard 140, which is applicable to many organizations.

• #11873 The URL used for a Git builder is now displayed in the UI for associated Git packages.

• #12624 Adds new blocklist flag --deleted-packages to block packages that have been removed from PyPI or CRAN from older snapshots.

• #13037 Adds new rspm_license_days_left Prometheus metric for more convenient alerting.

• #13366 rspm completions for the fish shell can be generated with rspm completion.

• #13297 rspm update will now default to the latest snapshot if the --commit flag is absent for curated PyPI sources.

• Updated to Golang 1.22.2.

• #9509 Package Manager’s version will be included in the User-Agent header when syncing packages.

Fixed

• #12560 Disables the calendar selector when an R repository is only subscribed to a Bioconductor source.

• #12022 Improved error message when using the rspm add command with invalid flags.

• #12559 Properly display binary files in UI for repositories that mix CRAN and Bioconductor sources.

• #12626 Delete Python Git builders when a Git Python source is deleted.

• #12448 The Server API Guide “Try it out” URLs now respect the path of the public server URL configured in Server.Address. The Server API Guide URLs can still be customized separately using the Swagger.Host and Swagger.BasePath settings.

• #12448 The Swagger.BasePath setting no longer needs to end with /__api__. This may be removed from any existing Swagger.BasePath settings.

• #12708 The Database.Provider configuration option is now case insensitive.

• #11836 Python packages will no longer hyperlink malformed extra package links.

• #9422 Orphaned Python packages are now deleted when running rspm evict --type packages.

• #12730 Fixed a bug where the usage stats page would no longer render charts after changing the chart options.

• #12804, #12687 Archived packages for combined repos are properly filtered based on subscription order.

• #12936 Fixed the incorrect repository URL for Bioconductor repositories on the Setup page.

• #9209, #12938 Fixed an issue preventing Linux binary packages in local and Git sources from being served for old, deprecated R versions.

• #11633 Fixed an issue preventing Linux binary packages in local and Git sources from being served for the arm64 architecture.

• #13206 Increased the systemd StartLimitBurst from 3 to 30 for more reliable recovery.

• #13331 Fixed an issue that was causing temporary files to accumulate when downloads failed.

• #13475 Fixed the output of the rspm list git-builds command to return valid JSON when the --output-format=json flag is provided.

• #13383 Only attempt Git credential decryption once to avoid spurious logs about potentially sensitive values in plain text.

• #13407 Double the default timeout for the rspm cluster [online/offline] commands.

• #13415 Fixed an issue where the rspm [online/offline] and rspm cluster [online/offline] commands will intermittently timeout.

• #6980 Fixed an issue where some packages could not have their checksum computed which caused some packages to be missing.

• #12874 Logging has been improved when a secret decryption fails.

• #12543 The UI no longer shows statistics on the home page unless a relevant repository exists.

• #12777 List items in the Package Details UI are now more easily clickable.

• #12545 Server logs are improved when Python cannot be autodetected.

• #12540 The stats page now saves the selected ecosystem.

• #12558 Warnings are now shown when curated repositories exist without the proper license.

• #12528 The run-diagnostics script now excludes large binary files from the report.

• #13209 The error page now presents a generic error message instead of internal errors.

• #12729 Fixed a migrate database bug when migrating with stale data in job_launcher_jobs and git_package_builds; these tables will now be ignored.

• #12587 Underlines package links on the activity page for R and Bioconductor repositories following accessibility best practices.

• #13171 Repositories with empty Curated CRAN and PyPI sources no longer show an error.

• #13150 The rspm create source now displays a better error when an invalid type is provided.

• #13190 CRAN snapshots in error messages are formatted correctly.

• #13341 Some archived CRAN packages were missing the occurred field.

• #13405 Some documentation redirects were misconfigured.

• #13166 Fixed a deadlock that can occur during syncs.

2023.12.0

December 18, 2023

Breaking

• #9762 Ubuntu 18.04 (Bionic) has reached vendor end of support and is no longer supported.

• #11867 Removes support for extracting README files for local and Git packages created in Package Manager versions prior to 1.0.6. If you are upgrading from a version prior to 1.0.6, this means that existing packages in local and Git sources will be migrated correctly, but Package Manager won’t automatically extract README data for the migrated packages. You can work around this limitation by upgrading to version 2023.08.0 prior to this version.

New

• #11932 Adds package vulnerability reporting based on osv.dev advisories. Known security vulnerabilities will be displayed on the Package page for CRAN, Bioconductor, and PyPI packages.

• #11931 Adds --vulns option to rspm create blocklist-rule to block packages with known security vulnerabilities.

• #9749 Database migrations are now stricter when comparing data. Migration errors now display the table and column where mismatch occurred.

• #11952 Adds support for creating Git builders with Python packages using rspm create git-builder command.

• #11935 Adds banner for blocked packages, archived versions, and distributions. If a description exists for the blocking rule, it will be displayed on the banner.

• #11967, #11971 Grayed out various broken URLs for downloading package binaries, distributions, etc. if they are known to be blocked.

• #11964 Adds rspm create bulk-blocklist-rules (alias rspm create bulk-bl) command to bulk add blocklist rules via file or STDIN.

• #6544 The pre-install script now creates a symlink from the rspm command to the /user/local/bin directory and, if available, initializes bash autocompletion.

• #10071 The rspm delete blocklist-rule command now supports bulk deletion of either all or a subset of rules with specified --id flag.

• #11881 The R Package page now displays the sub-path of the package within the repository if present, such as Path: Older or Path: 4.4.0/Recommended.

• #4594 Render Python reStructuredText READMEs in the UI.

• #8490 Adds the Git.AttemptVignettes option to attempt building R Package Vignettes through the Git Builders.

• #11923 Adds the source type and SPDX license types for package requests to the service log using the src_type and lic_type fields.

• #12051 Adds new endpoints to gather vulnerability information on sources, repositories, and packages.

• #12079 Adds EnvironmentFile support to systemd service definitions.

• #11801 When the Server.RVersion option is unset, attempt to autodetect R by checking the PATH and some well-known installation directories.

• #12078 Adds support for uploading Python packages to local-python sources with the rspm add CLI command.

• #12101 Adds ability to pass in a directory for the --path flag when uploading packages with rspm add, supported for both local and local-python sources.

• #11935 Adds [CRAN, PyPI, Bioconductor].DelaySyncDuration config option to have the ability to delay sync by a certain number of [hours|days].

• #12104 When the Server.PythonVersion option is unset, attempt to autodetect Python by checking the PATH.

• #12271 The webpage footer now displays the product tier.

• #12273 Adds support for increasing Git cloning depth when adding/editing Git builders with a new --clone-depth=[depth] flag.

• #10858 Adds support for openSUSE 15.5 and SLES 15 SP5.

• #12249 Adds support for new license tiers (Basic, Enhanced, and Advanced).

Fixed

• Accessibility improvements in the UI.

  • #11739 Fixed keyboard navigation of radio button groups on the Setup page.
  • #11794, #11805, #11824 Fixed missing accessible labels and markup for disclosure buttons on the Packages page, Activity page, and navigation bar.
  • #11821, #11795 Fixed missing accessible labels on search inputs and their clear buttons for packages and usage stats.
  • #11793 Removed duplicate empty link in the navigation bar.
  • #10738 Copy buttons are now better labeled with unique descriptions.

• #11898 Navigating between Python packages had a noticable delay.

• #12280 Minor performance improvements to R and Python package serving when packages have been blocked.

• #12296 Sandboxed Git builders now share the same network configuration as the host so they can pull external dependencies.

• #12323 Fixed the empty git-upload-pack given error that ocurred with Git builders for Azure Git repositories.

• #12379 Increased the default package cache size.

• #12532 Fixed an issue with incorrect “Content-Length” header reporting when using S3 with client-side KMS encryption.

• #11784 Respect proxy environment variables (http_proxy/https_proxy) with remote CLI usage.

2023.08.4

October 30, 2023

Fixed

• #12138 Fixed an issue where git-builders could not be created when the scheme (e.g. ssh://) was prepended to the URL.

• #12135 Fixed an issue that could prevent Git builds from working unless sandboxing was disabled via the Git.AllowUnsandboxedGitBuilds = true setting. This most commonly occurred when using a Linux Security Module such as SELinux.

2023.08.2

October 19, 2023

Fixed

• #11870 Package Manager now attempts every PACKAGEMANAGER_DISTRO when autodetection of the OS fails.

2023.08.0

September 12, 2023

Breaking

• #10439 For custom binaries, some distribution aliases such as rhel7 have been deprecated, use supported distros from rspm list distributions instead, such as centos7.

• The rspm create token command now forces the use of the --scope flag. If left blank, it will no longer default to --scope=sources:write.

• openSUSE 15.3 and SLES 15 SP3 have reached vendor end of support and are no longer supported.

• #10955 Git builders no longer require the Job Launcher. Any Git builds in the job queue at upgrade time will be canceled, but will be rescheduled at the next Git builder poll.

• #10955 The [Launcher] configuration section has been deprecated since Git builders no longer require the Job Launcher. Please remove any existing [Launcher] sections from your configuration files.

• #10955 Logs for previous Git builds will be inaccessible after upgrading. Use the rspm logs command prior to upgrading to retrieve any Git logs that must be preserved.

• #10982 When Git.AllowFileURLs = true and any Git builders use file:// URLs, Git must be installed on the server.

• #11095 The default storage alerting threshold has been changed from 75% to 90%. To restore the original setting, add StorageAlerts.Threshold = 75% to your configuration file.

• Installers are signed with a new Posit GnuPG key. See the Posit Signed Builds page for more information about signed builds.

• #11356 The default permission for the user.conf systemd configuration file has been changed from 0600 to 0644 to prevent warnings about world-inaccessibility.

• #11510 Disabled binary distributions no longer appear in the UI as a selectable distribution.

• #11631 The PACKAGEMANAGER_ENCRYPTION_KEY environment variable will now take precedence over a key file at the [Server].EncryptionKeyPath location instead of failing to start.

New

• #10376 Adds automatic PyPI synchronization. Package Manager will synchronize the PyPI source on demand and check for PyPI updates every 10 minutes.

• #9883 Enables remote token authentication for rspm create git-builder

• #10544 CRAN and PyPI repositories now support nearest-snapshot matching when used with date-based URLs. See Snapshot Identifiers in the Admin Guide for details.

• #10557 Adds new block list token scope --scope=blocklist:read for rspm create token command. See also breaking changes.

• #10557 Enables remote use for all blocklist CLI commands, e.g. rspm list blocklist and rspm test blocklist

• #10939 Adds the ability to rerun a Git builder job for a specific Git SHA.

• #8799 Supports Git builders with custom names by adding an optional --name flag.

• #7111 Adds support for Git submodule recursion when adding/editing Git builders with a new --recurse-submodules=[depth] flag.

• #5603 Adds a Git.AllowTagVersionMismatch setting to allow Git builds when the Git tag version does not match the DESCRIPTION file version.

• #11010 Adds support for serving precompiled binary packages for Debian 11 (Bullseye) and Debian 12 (Bookworm).

• #10588 Adds Server.CustomHomeTitle config option to have the ability to customize the Home Page UI text.

• Adds support for macOS R package binaries for both x86 and Apple Silicon (arm64) CPU architectures. These are available for R versions 4.1, 4.2, and 4.3 on CRAN or user-uploaded.

• #10504, #11132, #10502 The Homepage page has been redesigned to be more functional.

• #10503, #10589 The Setup page in the UI has been redesigned to be easier to navigate.

• Many accessibility improvements have been made to the UI.

  • Tab navigation is now fully supported.
  • Keyboard focus has been improved.
  • Semantic HTML tags such as header, link, and button elements are now better used.
  • Usage graphs now contain a textual representation that is accessible to screen readers.
  • Color contrast has been improved.
  • Links are underlined.
  • Page titles update on navigation.
  • Images, aside from those in package READMEs, now contain alt text.
  • Form fields now have attributes set for screen readers.
  • Modal dialogs no longer lose keyboard focus.
  • maximum-scale is no longer set.

• #10505, #10594 Most UI pages now fill the width of the browser.

• The UI will retry failed requests.

• The UI will cache and update API responses.

• The UI better displays when a Readme is available for a package.

• #10604 The What’s New page hierarchy is easier to navigate.

• The UI URLs now contain more information about what screen the user is on.

  • #10723 The repo routes now use the repository name instead of ID.
  • #11217 The source on the Activity page route is now the name instead of the ID.
  • The packages routes now include more information about the package ID and whether a user is on the Overview or Readme pages. (#10600)
  • #10722 The Setup page URLs now contain query parameters that make it easier to share links.
  • #11517, #11288 URLs from previous versions of Package Manager will properly reroute to the new URLs.

Fixed

• #8433 Fixed an issue that caused Windows binary package serving and binary availability reporting to fail when using third-party integrations such as Artifactory. When third-party integrations do not support proxying ETag response headers, Package Manager now falls back appropriately.

• #10471 Fixed a bug where some archived R package requests served the package source when a binary was available.

• #10479 Fixed an issue where deleting Git builders while Git builds were still running could result in an incomplete cleanup of files in the Git.BuilderDir directory.

• #10484 Fixed an issue where deleting SSH keys for Git building while Git builds were still running could result in an incomplete cleanup of SSH agents.

• #10518 Fixed an incorrect error message in the server log when starting the server with invalid HTTPS credentials for Git building.

• #10512 Fixed an incorrect error message in the server log when deleting HTTPS credentials for Git building.

• #10926 Fixed an issue sanitizing weak etags from integrations which would lead to error logs like _W/"..: no such file or directory.

• #11075 Fixed a bug with the Binaries.Distributions setting where binary packages could still be served for disabled distributions.

• #11511 Fixed an issue with unbounded accumulation of cached PyPI manifest data. Older PyPI manifest data is now evicted at the normal eviction interval.

• #11512 Fixed a bug where arm64 Linux users were receiving x86-built R package binaries.

• #11631 Fixed a bug where the PACKAGEMANAGER_ENCRYPTION_KEY environment variable was not honored for Git builders.

• #11631 When the PACKAGEMANAGER_ENCRYPTION_KEY environment variable is set, an encryption key file is no longer generated at the [Server].EncryptionKeyPath location.

Deprecated/Removed

• #10557 The rspm create token --blocklist flag is deprecated in favor of --scope=blocklist:admin and --scope=blocklist:read.

• #10725 The Lock Package Data checkbox has been removed from the Setup page. Snapshots will continue to be backwards compatible and deterministic.

2023.04.0

April 28, 2023

This release of Package Manager introduces the ability to globally block packages for an entire instance, preventing downloads of packages with known vulnerabilities or prohibited license types. Additionally, Package Manager now supports creating curated subsets of PyPI with a curated-pypi source, allowing only the Python packages from PyPI you permit. This release also heavily optimizes the PyPI source, making synchronization happen instantly.

Breaking

• Upgrades from versions before 2023.04 may take longer than usual to start the first time due to a metrics data migration.

• #10197 Adds a new Persistent storage class for storing PyPI and Curated-PyPI data. If you have a [Storage] configuration section that references specific storage classes, you will need to add a value for the Persistent class. We highly recommend switching to the Storage.Default setting to avoid issues when new storage classes are added. See the Admin Guide for details.

• #9363 A fatal error will now occur when using an SQLite database on an NFS volume. Can disable this functionality by using the new Sqlite.NoNFSCheck = true option.

• #6964 Package Manager instances configured to use S3 for storage will now automatically store package files. Use the RetainFetchedPackages option to change this behavior.

• #9415 The individual [CRAN, PyPI, Bioconductor].RetainFetchedPackages settings have been deprecated in favor of a single Server.RetainFetchedPackages option.

• #9707 Python repos now prohibit using the id query parameter with the /repos/:id/packages/:key API endpoint.

• #9707 The rspm clear CLI command no longer supports the --type=pypi flag.

• #9962 The admin guide “Security and Auditing” page has moved to a security folder called “Server Security and Auditing,” redirects have been added.

• #9862 The admin guide “PyPI Mirroring and Local Python Packages” page has moved to a Python folder called “Python Packaging,” redirects have been added.

New

• #9962 Adds the ability to globally block packages across all snapshots and repos to prevent unwanted downloads. See the Package Blocking guide for more information.

• #9863 Adds the ability to create curated subsets of PyPI with the new curated-pypi source. See the Quick Start guide for more information.

• #9707 Major updates to the PyPI source. PyPI data is no longer stored in the database, which significantly reduces sync time and increases performance. If you are already using a PyPI source, you can take advantage of these improvements by running rspm sync --type=pypi immediately after upgrading.

• #9332 The API documentation examples will now autodetect the transfer protocol scheme and hostname.

• #7848 The UI now displays an alert banner when the license is close to expiration. The default threshold is 30 days, and it is configurable using the Licensing.ExpiryDaysReminder option. Can disable completely by using the new Licensing.DisableExpiryBanner = true option.

• #9617 Export application runtime metrics through the prometheus endpoint for better observability. Set the Metrics.Enabled = true option to enable.

• #9667 Adds new /[Repository]/[Snapshot]/web/packages/[Package Name]/DESCRIPTION endpoint to support calls from remotes::install_dev for R repositories.

• #9648 The error message when trying to create, add, or update a Curated CRAN source for a snapshot that doesn’t exist now outputs nearby snapshot dates.

• #9858 The Usage Stats page now counts multiple license specifications as individual licenses (e.g., GPL-2 | GPL-3 as GPL-2 and GPL-3).

• #10028 Frozen URLs for Python repos no longer include the “Lock Package Data” checkbox.

• #6274 The output for the rspm list CLI commands now includes the pinned snapshots for curated-CRAN and CRAN-snapshot sources.

• #9955 The command rspm list sources can now be filtered by specific types of sources with a new --type flag.

• #9955 The command rspm list repos can now be filtered by specific sources with a new --source flag.

• #10212 The command rspm update now supports outputting JSON with --output-format=json.

• #9316 The documentation navigation bar has been updated to include the user guide, licenses, and release notes.

Fixed

• #9221 The Server API documentation now correctly lists all available values for the bioc_version query parameter.

• #9406 Git builds no longer fail with an expired certificate error when Package Manager has been running for longer than a year.

• #7019 Improved error messages when building Git packages with an invalid subdirectory.

• #9510 Fixed an unhandled error that could result in incomplete cleanup after failed syncs or other transactional operations.

• #9792, #9793 Fixed an issue where license info for some Python packages would be missing in the UI.

• #8682 Fixes an issue where some Python packages would display the full license instead of the license type on the Usage Stats page.

• #9910 Fixed an issue with displaying very long package names on the Usage Stats page.

• #9580 Addressed an open redirect vulnerability where Package Manager may redirect users to an untrusted external website based on a user-provided path in the URL.

• #10200 Fixed a bug where the migrate utility was creating an empty SQLite database when SQLite.Dir was unset, this now raises a no such file error. To resolve this, set an absolute path to the database in the SQLite.Dir setting.

• #9645 Fixed a bug in the logs documentation referring to Debug.Log = route instead of the correct Debug.Log = router.

• #9719 Fixed a bug that caused Package Manager to serve the source package when a Windows package binary was not found, instead of correctly returning a 404 error.

• #9960 Fixes an issue on the Usage Stats page where search queries containing certain special characters would not work.

• #9932 Fixed a bug in 2022.11 that incorrectly recorded usage stats by license type.

• #10343 Fixed a bug where Python version releases were sometimes not sorted properly.

Deprecated/Removed

• #9971 Deprecates the PyPI.DownloadConcurrency configuration option. This option is no longer relevant to PyPI.

• #9983 Removes the unused GET /repos/:id/first-transaction API endpoint.

2022.11.4

December 05, 2022

Fixed

• #9407 Fixed an issue that prevented some local Python packages from being uploaded with Twine.

• #9419 Fixed an issue that prevented some local Python packages from displaying correctly on the Package page.

2022.11.2

November 18, 2022

Fixed

• #9345 Fixed an issue that prevented serving R package binaries for archived packages.

2022.11.0

November 14, 2022

This release of Package Manager introduces the ability to upload your own Python packages, using the existing Twine toolset to upload packages to local Python repositories. In addition, Package Manager has been rebranded to reflect the new Posit branding.

Breaking

• #8399 Removes the top-level rspm import command, use rspm import ssh-key or rspm import https-credential instead.

• #8778 Migrates PyPI data into more appropriately named tables. This may slightly delay the first server startup time after the upgrade.

• #8586 The rspm add --replace flag no longer replaces packages stored with identical checksums.

New

• Adds the ability to upload local Python packages to a new local-python source. See the Quick Start guide for how to use this functionality.

• #7851 Set environment variable GIT_CEILING_DIRECTORIES to the Git builder directory during a Git build to protect against CVE-2022-24765 for customers who can’t upgrade Git immediately.

• #8509 Updates the Packages page in the UI to display the list of packages in a scrollable area.

• #8399 Adds new rspm edit [ssh-key|https-credential] commands to update Git builder credentials in place.

• Updates to Golang 1.19.

• #8935 Updates Launcher plugin to version 2.8.0 using Golang 1.19.

• #8387 Adds new --succeed-on-existing flag to the rspm [add|create|import|subscribe] commands for automation tools running the same commands each time.

• #7939 Omits debug symbols from the application binary, see the Go link command documentation for more information.

• #7282 Omits debug symbols from R binary packages for Linux, R 3.6 and above, significantly reducing the size of packages with compiled code.

• #8744 Adds an internal shortener to the fix URL lengths generated through the calendar date picker to 8 characters.

• #9117 Adds a new --hide option to the rspm edit repo command to hide repositories from the user interface.

• #8127 Adds support for Red Hat Enterprise Linux 9.

• #7933 Adds support for openSUSE 15.4 and SLES 15 SP4.

• Updates UI to NodeJS 1.18.

• Updates admin documentation dependencies.

• #8876 Improves activity page UI.

• #9044 Scroll long licenses in UI usage page.

• #8732 Rebrands application for RStudio’s change to Posit.

• #9133 Introduces a new User Guide focusing on use of Package Manager for the data scientist, based on the previous User Interface Overview page.

• #8152 Now soon-to-expire API tokens output a warning in the log.

• #8675 Python Package UI now displays the project homepage URL.

Fixed

• #8526 Fixed a bug where the sync command would ignore the Manifest.User and Manifest.Password settings.

• #8767 Fixed an issue that could prevent scheduled tasks from working in a cluster environment and cause the following error: Error verifying cluster integrity: node list length differs. This affected certain PostgreSQL configurations, such as PostgreSQL clusters deployed using Amazon Aurora Serverless v1.

• #7914 Fixed an issue that could cause Windows binary package installations to temporarily fail for newly released versions of R.

• #8571 Fixed an issue that could cause incorrect reporting of binary availability for local and Git sources.

• #8608 Fixed an issue that could cause incorrect reporting of binary availability for CRAN packages with R patch version dependencies (e.g., R (>= 3.5.1)).

• #9197 Fixed an issue with the reporting of binary availability for R versions and distributions that have reached end of support.

• #8916 Improved error messages when adding an existing package using the rspm add command.

• #8913 Fixed an issue that could cause a panic when switching from offline to online mode with Prometheus metrics enabled.

• #6396 Fixed an issue that left behind date aliases when using the rspm clear command.

• #8088 The Server API endpoints to query available binary packages now support R versions that have reached end of support.

• #9056 Removed a duplicate header appearing on the licenses page.

• #9113 Fixed an issue where certain Windows binaries couldn’t be added to a local source.

• #8319 Fixed rendering of the Debug section on the configuration guide.

• #9148 Fixed the example URLs for Python repos when using rspm url create.

• #9019 Fixed an issue where some UPSI URLs would include sources that were not subscribed to the repo anymore.

• #8485 Fixed issue when PACKAGEMANAGER_ADDRESS environment variable had a trailing slash.

• #8607 Correctly parse R versions with certain formats.

2022.07.2

August 2, 2022

Fixed

• #8428 Fixed a bug that caused incorrect download counts for a package when some versions of the package were deleted.

2022.07.0

July 19, 2022

This release of Package Manager introduces the ability to add your binary package builds for R packages. To help publish these binary packages, we’ve also included a new remote publishing feature that makes it as easy as ever to integrate with your build processes and CI/CD pipelines. Finally, we’ve taken the PyPI mirror source out of beta, and it’s ready for production.

Breaking

• Any Python repositories previously subscribed to the PyPI source need to be resubscribed and resynchronized. For more information, see the PyPI quickstart guide.

• #7807 Removes installation dependency for the curl and rrdtool software packages, which were not required or used.

• #8216 Removes recommended dependency on the r-base software package for DEB packages. To install R for building Git packages, we recommend installing R from the precompiled binaries at Install R.

• #7883 SLES 12 SP5 has reached vendor end of support is no longer supported.

• #7920 The recommended system requirements and installation instructions documentation pages have been migrated to the https://docs.posit.co/rpm/documentation/ site.

New

• PyPI support is ready for production use. The time required to sync information has been greatly reduced.

• Adds support for supplementing local and git sources with precompiled binary packages. See Adding Local and Git Binaries for more information.

• Adds support for API token authentication for remote CLI use. See API Tokens for details about enabling and using API tokens.

• You can now download the rspm CLI separately as a standalone application for Linux, Windows, or macOS.

• rspm add and rspm add binary now support remote use with API tokens. See Admin CLI Remote Use for more information.

• #7872 rspm add for local sources now supports installing multiple packages at the same time in a single snapshot. rspm add --path supports passing in multiple file paths that are comma-seperated. rspm add --file-in also supports passing in a CSV that contains all package paths. For examples on how to use this, see the Getting Started documentation for local packages.

• #8074 The encryption key can now be specified in the PACKAGEMANAGER_ENCRYPTION_KEY environment variable instead of using the key file directly. This is intended to make it easier to inject the encryption key into containers.

• #7349 Adds support for Ubuntu 22.04 (Jammy).

• #7818 Adds support for serving precompiled binary packages for R 4.2.

• #8132 Adds the Content-Disposition header to package download responses.

• #7926 The web UI now loads JavaScript dependencies through ESM modules. This will break compatibiltiy with browsers that don’t support ESM modules

Fixed

• #7764 The Activity Log UI will now display when a package is deleted from a Git source.

• #7799 Fixed a race condition when running rspm add after creating a repository that would sometimes log the error message Error: Unable to locate package(s).

• #7598 Fixed a bug that caused git-builders to lock up Package Manager until all builders were completed.

• #6984 rspm create git-builder will now use the default branch of a repository if the --branch flag is not provided.

• #8037 Fixed an issue where Git builds could fail if a commit was pushed to the remote Git repository before the build had completed.

• #8037 Improved performance of Git building for Git repositories with a large number of tags.

• #7624 Fixed an issue that could cause all Git builds to fail when running RSPM as root. This was a file permissions issue that prevented the Job Launcher from starting correctly. The data directory (/var/lib/rstudio-pm by default) is now given file permissions of 0701 instead of 0700.

• #7806 Added missing installation dependency for the libssl1.1 software package for DEB packages.

• #8222 Increases the number of attempts to download sync information to fix the error CheckpointDownloadRunner returned error: GET "...": unexpected HTTP status 500.

• #7925 Fixed an issue that prevented Job Launcher debug logs from being created. When enabled, Launcher debug logs are now written to Server.LauncherDir once again.

• #6454 The rspm-offline-downloader tool now supports downloading binary packages for newly released R versions and operating systems (including R 4.2 and Ubuntu 22.04) without requiring an upgrade of the tool. Note that future release notes for the RSPM Offline Downloader will located in the new Offline Downloader News page.

• #5271 The general performance of the rspm-offline-downloader get cran command has been improved.

Deprecated/Removed

• #8158 Deprecates the CRAN.Binaries configuration options in favor of the new Binaries.Distributions option. Users with a customized CRAN.Binaries setting should configure the new Binaries.Distributions option.

2022.04.0

April 12, 2022

This release of RStudio Package Manager provides new insight into which packages have pre-built binaries available for your desired R version and distribution. It also contains various improvements to Git building and many other bug fixes.

Breaking

• Deprecates the CRAN.ManifestURL, Bioconductor.ManifestURL and PyPI.ManifestURL configuration options. Note that users should configure the new Manifest.URL option.

• Removes the outdated info-cran command from the offline downloader.

• Deprecates calling the rspm import command without either the ssh-key or https-credential subcommand.

• Deprecates the --ssh-key argument to the rspm create git-builder command in favor of the --credential flag.

• Deprecates the rspm delete ssh-key subcommand in favor of the more general rspm delete git-credential.

• Deprecates the --new-ssh-key argument to the rspm edit git-builder in favor of the --new-credential argument.

• Deprecates the rspm list ssh-keys command in favor of rspm list git-credentials.

• Refactor the files and directories storage documentation into multiple pages.

• Removes the Source and Binary buttons on the Setup page for CRAN and Bioconductor. This simplifies how binary and source packages are displayed and served to the user.

• Changed field name from Name to Package in rspm add --csv-out CSV output file to be compatible with the standard package database format in R.

• CentOS Linux 8 has reached vendor end of support and is no longer supported. RHEL 8 remains supported, and continues to use centos8 in its binary package repository URLs for backward compatibility.

• openSUSE 15.2 and SLES 15 SP2 have reached vendor end of support and are no longer supported.

New

• The UI now displays whether a binary file is available for a CRAN package, and provides a link to download the binary package if available. On the package page, scroll down to the new “Binary File” section, and select a distribution and R version to check binary availability for that environment. To learn more about when binaries are available, see the Binary Availability documentation.

• Adds two new Server API endpoints to query available binary packages, /repos/{id}/packages/{name}/binaries and /repos/{id}/binaries.

• The /status API now returns Package Manager’s list of supported R versions for binary packages.

• Adds a new configuration stanza Manifest that can be used to change the outgoing URL, set a Basic authentication User, and set an encrypted Password field.

• Adds support for HTTPS credentials for Git builders. HTTPS credentials can imported using the new rspm import https-credential command, used to create Git builders using the rspm create git-builder --credential=<name> command, and listed using the new rspm list git-credentials command. See Importing an HTTPS credential for more information, including how to import credentials securely.

  • With the addition of HTTPS credentials, several commands have been changed to support both SSH keys and HTTPS credentials, including the addition of a new rspm import ssh-key subcommand to specifically import SSH keys. See the Breaking changes in this release for more information.

• When importing an SSH key with a passphrase, the passphrase file may now contain encrypted text from the rspm encrypt command.

• Adds --remove-credential argument to the rspm edit git-builder command, to dissociate a credential from a Git builder.

• Adds a new Git.AllowFileURLs configuration option that can be used to create a Git builder based on a local Git repo.

• Adds a new composite index to the metrics table to improve package view performance.

• Adds a new S3Storage.KMSKeyID configuration option that can be used to enable client-side encryption before transferring files to S3. See the S3 storage documentation for caveats and additional information.

• Adds the ability to configure Package Manager with environment variables. See the configuration documentation for additional information and examples.

• Adds a new /robots.txt endpoint to help search engine crawlers know what URLs they can access.

• System requirements and distribution updates will now use reloaded URL configurations. These previously required an application reboot to take effect.

• CSV files output with rspm add --csv-out can now be imported into R and used with tools::package_dependencies() to analyze dependencies before adding packages to a curated CRAN source.

• Rename the button Client OS to Distribution to allow for great flexibility in the future.

• Group official RStudio-supported distributions in the distribution picker.

Fixed

• Fixed a bug that was truncating commit and published timestamps from appearing for built Git packages. This fix will only work for published packages moving forward.

• Fixed an issue where some packages README images were not rendering correctly.

• Fixed an error with the /alerts API endpoint when storage auditing is disabled.

• Updated rspm encrypt command to output only the result on stdout.

• Fixed an issue where the locked status of a CRAN snapshot source was not accurately reflected in the frozen URL description.

• Fixed an issue where the UI could display invalid archived versions for packages in CRAN snapshot sources.

• System requirements and distribution updates will now use reloaded URL configurations. These previously required an application reboot to take effect.

• Removed the need to create socket file when running migrate utility, which requires that RSPM not be running.

• Fixed an issue with storage alerts for local file systems. This was preventing the service from starting properly.

• Fixed an issue where cache eviction tasks could run more frequently than intended and cause RSPM to respond slower.

• Package Manager no longer requires the --privileged flag to run in a Docker container. However, sandboxed Git builds still require system calls not permitted by Docker’s default seccomp profile, and mount operations not permitted by the default AppArmor profile. You will need to either (a) start the container with --security-opt 'seccomp=unconfined' and --security-opt 'apparmor=unconfined'; (b) provide alternative seccomp and AppArmor profiles; or (c) set Git.AllowUnsandboxedGitBuilds = true in your configuration to disable sandboxed builds entirely.

• The RSPM installer for RHEL 8 is now correctly signed with the RStudio GnuPG key.

• Fixes a bug that was causing some CLI commands to fail with a 5xx response. In the logs this appeared as ERROR: payload string too long (SQLSTATE 22023).

2021.12.0

December 23, 2021

Breaking

• The calendar will now only display dates as selectable when an update or transaction occured for that repository. The rspm url create command can be used to generate a URL for any date and set of transactions.

• The default minimum TLS version is now correctly configured as 1.1, instead of defaulting to 1.0. Note that this can be changed using the HTTPS.MinimumTLS configuration option.

New

• Adds support for openSUSE 15.3 and SLES 15 SP3.

• Adds a new configuration option Server.LegacyCalendarTransactionURL that can be used to revert single-source repositories to use a numeric identifier (e.g. /repo/4115) in the calendar URLs instead of the default hash values.

• The calendar will now display the snapshot date as a valid date on the calendar instead of the transaction date for CRAN snapshot sources.

• Introduced code splitting to improve webpage loading times.

Fixed

• Performed security and dependency upgrades for libraries used by the server and web interface.

• Improved the caching layer throughout the product. This should result in faster package downloads, page loads, and greater scalability due to lower database usage.

• Fixed a timezone issue where the browser’s selected calendar date and the URL generated by the server could differ by one day.

• Fixed an issue with leadership election that could result in two or more leaders being elected and the Error verifying cluster integrity: node list length differs log line.

• Fixed an issue with leadership election that could result in the Error pushing leader assumption work to queue log line, failing requests, and/or the service taking a long time to restart.

• Fixed an issue with leadership election and multiple interfaces on an instance resulting in the node "X" with IP "Y" from store not known by leader log line.

• Fixed an issue serving R package binaries for new operating systems and R versions, such as openSUSE 15.3 and SLES 15 SP3, or R 4.2 and above.

• Fixed an issue that prevented system requirements from being listed for new operating systems, such as openSUSE 15.3 and SLES 15 SP3.

• Fixed an issue that could prevent R packages encoded in Latin-1 from being installed in R 3.5 or below.

• Fixed an issue with static assets not caching correctly in the UI.

• Fixed a bug that was incorrectly logging Warning: SQLite directory error message for some PostgreSQL installations.

2021.09.0

September 8, 2021

This release of RStudio Package Manager contains a new calendar view and improved way to freeze your set of packages. It also contains logging improvements and many important bug fixes.

Breaking

• The default logging location has been moved from /var/log/rstudio-pm.log to /var/log/rstudio/rstudio-pm/rstudio-pm.log. This will also impact the access logs.

• The following operating systems have reached vendor end of support and are no longer supported:

  • Ubuntu 16.04 (Xenial Xerus)
  • openSUSE 42.3
  • openSUSE 15.1
  • SLES 15 SP1

• Dates returned to the Usage Stats page are now ISO 8601 dates rather than a full RFC3339 timestamp.

• The minimum number of PostgresPool.MaxOpenConnections will now be set to 10.

• Air-gapped customers using Bioconductor with RSPM 1.2.0 or 1.2.2 are required to fetch the new v4/1 schema after upgrading RSPM to 2021.09.0, but before syncing the Bioconductor source. Please refer to the admin guide for more details. The 1.2.2.1 release includes this step, and you need not repeat it if you already updated to that release.

• The date aliases for the CRAN source will now use UTC as the basis for the date.

• Both the Activity page and the Setup page will now use UTC for all dates and times.

New

• Introduces a new, more flexible repository calendar. Users can now freeze to any date in the repository’s history, and frozen repository URLs now include the snapshot date in YYYY-MM-DD format. The calendar is now supported in many cases where it previously was not, particularly for repositories with multiple sources. Existing repository URLs that use a numeric identifier (e.g.,/repo/4155) are still supported, and will continue to work. More information about the calendar is available in the User Interface Overview section of the Admin Guide.

• Adds a rspm url create command to create a frozen repository URL, and a rspm url explain command to explain what a frozen repository URL encodes.

• RSPM can now serve binary packages for new R versions and operating systems without upgrading to a new version. The list of supported platforms is now synced from the RStudio Package Service.

• Git-builders may now be edited using the rspm edit git-builder command to change the SSH key, Git URL, branch, and subdirectory.

• Git-builders using “commits” triggers may now be configured to use the version in the DESCRIPTION file instead of the unique, timestamped version. See the new Git.ForceDescriptionVersion configuration option for more information.

• Adds additional logging indicating when CRAN, Bioconductor, and PyPI packages are being checked for updates.

• A PID file is now created to track the Package Manager process ID.

• Adds two new sections to the documentation that describe available command-line options: Command-Line Interface and Offline Downloader.

• Logs are now available through journalctl.

• The UI and CLI will now provide better error messages to help customers get started with setting up repositories and sources.

• The general performance of the rspm-offline-downloader get cran command has been improved. By default the concurrency value is set to 10 and the --concurrency flag accepts higher values for quicker downloads.

• Adds a more helpful error message when attempting to unsubscribe a Bioconductor repo from a source. This action is not allowed because Bioconductor repos are automatically subscribed to sources.

• Adds support for the Bioconductor books repository. The books repository will be available in Bioconductor sources after the next Bioconductor sync.

• The PyPI source now supports YYYY-MM-DD date aliases for frozen repository URLs.

• Adds a new rspm completion command to generate a CLI autocompletion script for Bash. More information is available in the Admin Guide.

• Starting with this release, RSPM will now use a calendar-based versioning scheme.

Fixed

• Fixes an issue where Bioconductor syncs could treat the order of sync actions incorrectly, leading to sources that fail to sync. This issue only affects users of Bioconductor repositories. If you are upgrading from RSPM 1.2.0 or 1.2.2, please use rspm sync --type=bioconductor to resync your Bioconductor sources. The 1.2.2.1 release includes this step, and you need not repeat it if you already updated to that release.

• Fixes a bug that could schedule two or more interfering package updates for the same source.

• Fixes a bug where some SSH keys with passphrases were not being imported correctly.

• Fixes a bug that prevented packages from being added to curated CRAN sources with certain --snapshot flag values.

• Fixes a bug that could prevent the election of a leader in HA clusters.

• The PostgreSQL driver has been upgraded to recover more quickly from lost connections and TCP resets. This also fixes an issue where some Azure customers were seeing a read: connection reset by peer error.

• Fixes a bug where HA clusters could not verify node integrity.

• Fixes loss of state in leader election during a loss of Postgres connection.

• All errors in PyPI sync are now retried so that more syncs are successful.

• Fixes confusing error message when Server.TempDir is not writable.

• The recommended CRAN snapshots for Bioconductor were too early and could cause Bioconductor package installations to fail. For Bioconductor repositories, we recommend configuring R to use the revised CRAN snapshots on the Setup page. For R repositories, we recommend adding an appropriate CRAN snapshot using the revised instructions in the Admin Guide.

• Fixes the instructions for using Bioconductor packages in an offline environment with newer versions of BiocManager (1.30.12 and above). If you are unable to use BiocManager offline, refer to the revised instructions on the Bioconductor repository Setup page.

• Fixes a XSS-vulnerability with the experimental API swagger docs. The swagger UI has been upgraded to the latest version 3.51.1 in the process.

• Fixes a PyPI sync bug that was impacting PostgreSQL users with the search_path option.

• Fixes a rare bug that could prevent the application from starting after upgrading from version 1.1.6.1-* or earlier.

• Fixes an issue with serving PyPI packages with plus signs in their filename.

Deprecated/Removed

• Deprecates the Git --branch option when used in conjunction with the --build-trigger=tags flag.

• Discontinues support of openSUSE 15.1, SLES 15 SP1, and Ubuntu 16.04 (Xenial Xerus) R binary packages. RSPM will continue to serve existing binary packages for these operating systems in perpetuity, but no longer provide new binary packages after several months. Please refer to the Admin Guide for more information about the supported operating systems and R versions for binary packages.

• Internet Explorer 11 is no longer supported. Please see our Platform Support page for a list of supported browsers.

• Deprecates the --cache-dir flag from the rspm-offline-downloader get cran command as caching and fast updates will now be enabled by default.

1.2.2.1

May 13, 2021

Breaking

• Air-gapped customers using Bioconductor with RSPM 1.2.0 or 1.2.2 are required to fetch the new v4/1 schema after upgrading RSPM to 1.2.2.1, but before syncing the Bioconductor source. Please refer to the admin guide for more details.

New

• Adds support for serving precompiled binary packages for R 4.1.

Fixed

• Fixed an issue where Bioconductor syncs could treat the order of sync actions incorrectly, leading to sources that fail to sync. This issue only affects users of Bioconductor repositories. After installing this release, please use rspm sync --type=bioconductor to resync your Bioconductor sources. Bioconductor updates for the previous RSPM versions (1.2.0, 1.2.2) will not be updated going forward.

• Fixed an issue where Bioconductor syncs could fail when using PostgreSQL.

1.2.2

March 02, 2021

Breaking

• RStudio Package Manager no longer supports Red Hat Enterprise Linux/CentOS Linux 6.x.

• Any Python repositories previously subscribed to the PyPI source need to be resubscribed and resynchronized. For more information, see the PyPI quickstart guide.

• Removes Git support from the rspm add command. Use the new rspm create git-builder command going forward.

• Removes deprecated rspm clear-cran command. Use the new rspm clear --type=cran command going forward.

• RSPM will now validate S3 storage configuration options on start up.

New

• Package Manager now provides filesystem storage auditing and alerting. When storage exceeds user-configurable thresholds, the server will alert in the log as well as the UI. More information is available in the Admin Guide.

• Operational metrics can now be exported via a Prometheus-compatible endpoint to empower your own monitoring and alerting systems. More information is available in the Admin Guide.

• Python packages now display additional release information including download links, SHA256 values, and the yank status.

• Python packages release are now paginated in the UI.

• Use the new [Storage].Default option to configure all variable storage classes together, for example setting [Storage].Default = S3 will ensure all packages are written to your S3 bucket.

• Configure the maximum time to wait when connecting to the database by using the [Database].ConnectionTimeout option.

• Package Manager can now be installed on both openSUSE 15.2 and SLES 15 SP2 systems.

• Precompiled R binary packages are now available for openSUSE 15.2 and SLES 15 SP2.

• System requirements information can now be listed for openSUSE 15.2 and SLES 15 SP2.

• Additional startup validation is performed when using PostgreSQL with a search path.

• Clusters now automatically elect a leader node. The leader manages jobs like schedule syncing and cache eviction to avoid duplicated work.

• Package Manager now uses asynchronous messaging instead of database locking to track active work (like syncing CRAN sources); this improves performance and helps eliminate database resource contention.

Fixed

• Fixes an issue that could result in syncing snapshots more than once, resulting in corrupted data. In the unlikely event that your installation is affected by this bug, you will be unable to start RSPM, and you will see the following error in the log:

  Error running services: Error: Unable to initialize a connection to the
  database: UNIQUE constraint failed: checkpoints.source_id, checkpoints.guid, checkpoints.version

If your installation is affected, please contact support. You can reinstall the previous RSPM version and continue using RSPM until the issue is resolved.

• Some malformed or incorrect database configurations prevented startup and did not crash, these will now timeout accordingly.

• Improves robustness of PostgreSQL database connections by automatically reconnecting when connections are lost.

• Git builders now respect the specified --ssh-key flag when cloning repositories.

• Fixes a race condition when building large Git repositories that was causing intermittent failures.

• Fixes an issue with adding Git packages that have blank lines in their DESCRIPTION file.

• Duplicate Python packages are no longer presented in the UI.

• Some Python packages and files were missing from RSPM.

• Patches the UI dependency marked to remove a potential Denial-of-Service (DoS) vulnerability.

• We’ve improved the PyPI source sync operation; syncing should complete much more quickly and reliably. See the breaking change below about resubscribing and resyncing Python repositories.

1.2.0

November 24, 2020

Bioconductor Support

• Bioconductor is now supported through a series of changes. We recommend upwards of 1 TB additional disk storage, and admin CLI actions are required to enable Bioconductor. Learn more about how to serve Bioconductor packages in the admin guide.

• Adds a new Bioconductor repository type. Bioconductor repositories can be created using the rspm create repo --type=bioconductor command.

• Adds new source types representing Bioconductor releases and R repositories within a release. These sources can be added to Bioconductor or R repositories.

• Adds a new --type flag to the sync command that distinguishes between syncing CRAN and Bioconductor metadata.

• Adds rspm-offline-downloader support for Bioconductor data.

• Adds support in the web interface for Bioconductor repositories, including a new Setup page for working with BiocManager and Bioconductor repositories.

• Adds support in the CLI for listing Bioconductor repositories, sources, and packages. Adds a new rspm list bioconductor versions command to list available Bioconductor releases.

• Adds support to the Server API for Bioconductor metadata and repository information.

PyPI (Beta)

• PyPI mirroring is now supported in beta through a series of changes and additions. We recommend upwards of 1 TB additional disk storage, and admin CLI actions are required to enable PyPI. Learn more about how to serve PyPI packages in the admin guide.

• Adds a new Python repository type. Python repositories can be created using the rspm create repo --type=python command.

• Adds new --type flag to the sync command that distinguishes between syncing CRAN and PyPI metadata.

• Adds a PyPI config section for setting PyPI related configuration attributes such as the PyPI sync schedule.

• Adds a new pypi source that is enabled by default when using a Python repository.

• Adds support for listing and searching for Python packages.

• Adds support in the web interface for PyPI repositories including searching for and displaying package data.

• Adds support for routing pip requests.

• Adds support for tracking PyPI package downloads and corresponding display in the Usage section of the web interface.

• Adds support to the Server API for PyPI metadata and repository information.

• Adds a new rspm clear --type=pypi command to clear PyPI metadata, for removing PyPI as a source, or for resyncing a fresh copy.

Changes to Curated CRAN Sources

• Curated-CRAN sources can now be created using a --snapshot flag to specify an initial snapshot date. For example --snapshot=2019-11-07. A new rspm list cran snapshots command shows the available snapshot dates.

• Curated-CRAN source add and update operations now support passing a snapshot date via the --snapshot flag, e.g., --snapshot=2019-11-07. Passing the --transaction-id flag is deprecated but still supported. The --commit flag is now required for both.

• A new source type, cran-snapshot is available for creating a source that contains ALL of CRAN but only for a specific date. Like Curated-CRAN sources, CRAN-Snapshot sources can be updated using the rspm update command.

Misc

• Adds new storage classes for Bioconductor and PyPI. If you use a non-default storage location for packages (e.g., S3), please configure the correct storage location for Bioconductor and PyPI before upgrading.

• BREAKING: Removes the rspm-offline-downloader get-cran command. Use rspm-offline-downloader get cran going forward.

• Improves download resiliency of the rspm-offline-downloader tool through increasing the number of retries and adding a timeout using exponential back-off.

• Adds new --starting-snapshot flag to the rspm-offline-downloader tool that can be used to download RSPM CRAN data starting at a particular snapshot. Note: This does not impact R package binary downloads.

• Adds new validate-cran command to the rspm-offline-downloader to validate that the destination contains all relevant snapshots and directories for RSPM to work correctly.

• Updates the rspm edit repo command to no longer require the --new-name flag when updating a repository’s description.

• Fixes a bug where local and Git packages could have missing package dependencies.

• Prevents source sync from occurring thirty minutes after the desired schedule.

• NOTICE: When using Postgres, RStudio Package Manager now verifies that a minimum version of 9.5 is being used. A warning message will be logged if the version of Postgres being used is older. The 9.5 minimum version is also noted in the PostgreSQL section of the Database chapter of the Admin Guide.

• Updates UI search to prioritize exact matches first, also restricts matching-search to three or more characters.

• Deprecates the clear-cran command. Use the new clear --type=cran command going forward.

• Fixes a bug that could result in job queue deadlock under load. This prevents issues that could cause the RSPM service to stop responding.

• Adds a response header to help identify Package Manager in requests: X-Repository-Type: RSPM

• The Activity page in the web interface now shows the snapshot dates for the cran source, not the dates the snapshots were synchronized. This makes the Activity page easier to navigate and consistent with the repository calendar.

• A repository that only subscribes to the cran source can now be indexed by dates as well as transaction IDs. The date aliases are shown in the repository Setup page where applicable.

• The Package page now displays older package versions in descending chronological order.

1.1.6.1

July 13, 2020

• Fixes a bug where Git builders could be created in non-Git sources, causing the rspm list git-builders and rspm list git-builds commands to fail.

1.1.6

June 23, 2020

• BREAKING: Removes the --dryrun CLI flag that was required when adding or updating packages to curated-CRAN sources. Attempting to use this flag will result in a command error.

• BREAKING: Use the Apache Combined Log Format as the default access log format instead of the Apache Common Log Format. Switch back by setting Server.AccessLogFormat = "common".

• BREAKING: The CLI now waits for commands to complete by default. The following CLI commands are affected: rspm sync, rspm create git-builder, rspm run git-builder, and rspm rerun git-builder. Use the new --no-wait flag to run these commands asynchronously without waiting. The --wait flag remains available for backwards compatibility.

• Adds rspm offline and rspm online admin CLI commands to support taking services offline and bringing them back online safely.

• Adds rspm cluster offline and rspm cluster online commands to the admin CLI to support taking multiple nodes in a cluster offline and bringing them back online.

• Adds a rspm cluster nodes command to the admin CLI to support listing nodes in a cluster.

• Adds a rspm config debug logger commmand to temporarily alter the debug log configuration without restarting the Package Manager server.

• Updates the Admin Guide High Availability and Load Balancing chapter with a new guide for upgrading a cluster.

• Adds a new experimental Server API documentation for commonly requested endpoints. For more information see the new documentation.

• Adds support for Ubuntu 20.04 LTS.

• Adds support for serving precompiled binary packages for Ubuntu 20.04 LTS.

• Adds support for listing system requirements of packages on Ubuntu 20.04 LTS.

• Adds new Proxy.User and Proxy.Password configuration options to securely configure outbound proxies.

• Deprecates the rspm add command for Git packages. Use rspm create git-builder going forward.

1.1.4.1

May 20, 2020

• Adds support for serving precompiled binary packages for R 4.0.

1.1.4

April 10, 2020

• Adds a new storage class for CRAN. Upgrading will result in a migration of existing CRAN packages and README files to the new storage class. If you use a non-default storage location for packages (e.g., S3), please configure the correct storage location for CRAN before upgrading. All CRAN packages will be moved to the new CRAN storage location upon service startup. If your installation has downloaded many CRAN packages, this may take some time, and the service will be unavailable until the migration is complete.

If the storage class configured for CRAN is of a different type than the packages storage class, startup will fail. If you wish to migrate CRAN packages to a different storage type, enable the Migration.EnableMixedClassMigration = true configuration property.

• Adds eviction for orphaned packages. Git and local packages that are stored but no longer referenced in any sources will be removed periodically.

• Adds a new CLI command list git-builds that can be used to review Git builder runs and debug potential problems.

• Adds better caching and improves performance by:

  • Adding configurable settings for in-memory caching.
  • Caching system requirements data for better performance.
  • Enabling package request caching by default.

• Updates the license-manager command to incorporate recent bug fixes.

• Adds the package size for local and Git packages to the Web client.

• Adds the Git SHA to the Web client when displaying package information for packages from Git sources.

• Adds an example configuration file that includes all the available configuration settings and their defaults at /etc/rstudio-pm/rstudio-pm.gcfg.defaults.

• Fixes a bug where adding Git packages via SSH could fail with certain SSH server configurations.

• Fixes a bug where adding Git packages could fail with custom R startup files present.

• Fixes an issue with rendering SVG images in package READMEs.

• Fixes an issue where build-id files installed in /usr/lib/.build-id/ could conflict with other RStudio products and cause install errors.

• Fixes an issue where out-of-sync system requirements could prevent the server from starting. This improves support for running RStudio Package Manager in offline (air-gapped) environments.

• Updates the admin guide, licenses, and news documentation to use mkdocs.

1.1.2

February 26, 2020

• RStudio Package Manager 1.1.2 includes beta support for pre-compiled R package binaries for Windows. Windows R package binaries can be installed much faster without the need to install system dependencies. More details are available in the admin guide.

• Support for CRAN repos with versions older than 1.0.6 has been removed. Updating to version 1.0.6 or later is now required for CRAN support.

• Eviction Policies

  • Adds the ability to configure eviction policies that control the lifetime of stored objects. Eviction policies can be used to keep server disk usage to a minimum. Learn more in the admin guide.
  • Startup after upgrading RStudio Package Manager may take some time since all stored objects will be recorded in the database. If you are upgrading multiple nodes in a cluster, please allow the first node to completely start up before starting additional nodes.

• Fixes a bug where a bad database connection to PostgreSQL or SQLite would cause a panic.

• Support for TLS 1.3. Access to this TLS version is available without additional configuration.

• The setting HTTPS.ExcludedCiphers has been removed and is no longer supported. The HTTPS.MinimumTLS setting should be used to specify a minimum accepted TLS version. We recommend running a secure proxy when your organization has more complex HTTPS requirements.

• Adds support for serving precompiled binary packages for CentOS/RHEL 8.

• Adds support for listing system requirements of packages on CentOS/RHEL 8.

• Fixes a bug where shutting down the server sometimes resulted in orphaned job launcher processes.

• Adds a migration utility that can be used to migrate to a different database provider. Learn more in the admin guide.

• Fixed a bug in which CPU usage of the rstudio-pm service would increase over time when using SQLite as a database.

1.1.0.1

November 22, 2019

• Fixes a bug that both impacted the server performance and resulted in potentially serving incorrect binaries when fetching binary packages for a non-current checkpoint.

1.1.0

October 31, 2019

• Adds two new configuration settings, Server.PackageRewriteCompressionLevel and Server.PackageRewriteBufferSize that can be used to improve performance when installing packages in local sources. Learn more in the admin guide.

• Deprecates the --dryrun flag that was required when updating packages to curated-CRAN sources.

• The rspm-offline-downloader now supports downloading Linux R package binaries for offline environments. Learn more in the admin guide.

• Adds a new Proxy.URL configuration option to have RStudio Package manager use an outbound server proxy when making HTTP and HTTPS requests.

• Stops support of Ubuntu 14 (Trusty Tahr). With the Ubuntu EOL, and RStudio six-month support coming to a close, we will no longer be testing or supporting RStudio Package Manager on this version of Ubuntu.

• Deprecates the CRAN.SyncMode setting. Future releases will not support eager syncing for CRAN and curated-CRAN sources. The air-gapped installation approach can be used for situations that require preemptive downloads for CRAN or curated-CRAN packages. Learn more in the admin guide.

• Fixes a bug preventing git packages with a large number of tags from building.

• Adds support for installing very large packages in local sources.

• Adds support for SUSE Linux package binaries. See the repo setup page for more information.

1.0.14

October 2, 2019

• This release includes bug fixes and significant performance improvements.

• Deprecates the --dryrun flag that was required when adding packages to curated-CRAN sources.

• Adds support for RHEL 8.

1.0.12

September 10, 2019

• Beta: Introduces support for linux package binaries. Precompiled package binaries will be available for the majority of CRAN packages using R 3.4, 3.5 and 3.6 for Ubuntu 16.04 (Xenial), Ubuntu 18.04 (Bionic) and CentOS/RHEL 7. Please refer to the admin guide to start serving binaries.

• Introduces a service log which can be used to analyze how Package Manager is serving source vs. binary packages. Learn more in the admin guide

• RStudio Package Manager installers are now signed. Our signing key is available on the RStudio website. The Installation instructions in the RStudio Package Manager Admin Guide explains adding the RStudio key to your Linux distribution.

• Fixed bugs related to building Git packages and added log messages which can help diagnose Git problems more quickly.

1.0.10

July 8, 2019

• Introduces a new CLI command to list system requirements for packages in a given repository. Run rspm list requirements --help for more information.

• The system requirements for a repository are also available in the UI. See the Setup page for a respository in the UI.

• Updated UI Javascript code to address moderate CVEs published by NPM.

• Fixed a bug that prevented package system requirements from displaying correctly in certain circumstances.

• Fixed bugs and improved performance for transaction handling (i.e. “pinning” a repository to a certain date).

• NOTICE: When using Postgres, RStudio Package Manager now verifies that a minimum version of 9.4 is being used. A warning message will be logged if the version of Postgres being used is older. The 9.4 minimum version is also noted in the PostgreSQL section of the Database chapter of the Admin Guide.

1.0.8

April 18, 2019

• RStudio Package Manager now helps users find and install system dependencies of R packages for supported Linux operating systems. Installation commands for known system dependencies are displayed on the package page. System dependency information will be available after syncing. See the Admin Guide for more details.

• The process for setting up an air-gapped environment is simplified by using a new tool which does not require the AWS CLI. See the Admin Guide for updated setup instructions.

• Running RStudio Package Manager in a clustered environment using S3 as a backing filesystem is now officially out of beta.

• Improvements to logging when Git builders fail will help to more quickly diagnose problems with the build environment.

• Package listing and search is now much faster.

• Rendering package README files is improved and several layout bugs are fixed.

• RStudio Package Manager is now available for SUSE Linux Enterprise 15.

1.0.6

March 11, 2019

• BREAKING: Air-gapped customers are required to fetch the new v3/1 schema after upgrading before syncing the CRAN source. See the Admin Guide for more information.

• Important updates and fixes to Package Manager’s CRAN source. Past CRAN checkpoints will remain available. Users will see corrected browsing behavior for a small percentage of packages for new syncs.

• README files are rendered in the web page for each package. READMEs for packages in existing local and Git sources will be extracted automatically upon upgrading. READMEs for the CRAN source will be available after syncing. READMEs for existing packages in curated-CRAN sources will be unavailable, but, after syncing the CRAN source and updating the curated-CRAN source, READMEs for new and updated packages will be available.

1.0.4

January 25, 2019

• BREAKING: The R processes that build Git packages now run inside a sandbox for security. Only customers using Git sources are affected. SUSE/Ubuntu users will not require any changes. If you are using CentOS/RHEL, you will need to either (a) configure the Git.AllowUnsandboxedGitBuilds = true configuration setting, (b) reconfigure RStudio Package Manager to run as root, or (c) enable user namespace support (CentOS/RHEL 7 only). If you are running RStudio Package Manager in a Docker container, you will need to either (a) start the container with the --privileged flag or (b) configure the Git.AllowUnsandboxedGitBuilds = true configuration setting. Please consult the Admin Guide for more information.

• Archived packages (packages with no current versions) are now displayed in the RStudio Package Manager UI.

• The Setup page in the UI now includes a calendar that allows you to freeze your set of packages to a particular checkpoint.

• Added beta support for shared storage using AWS S3. See the Admin Guide for more information. IMPORTANT: AWS S3 support is in beta. Please do not use S3 for production data at this time.

1.0.2

December 5, 2018

• Git packages can now be built from subdirectories within a Git filesystem.

• Git packages can now use SSH keys with or without a passphrase.

• SSH connections when performing Git operations now utilize a private SSH agent process for improved security.

• Git packages now include the commit SHA in the package DESCRIPTION file for reference.

• Fixed a bug where Git commits could be built out of order if they were recorded in different timezones.

• Fixed a bug where Curated CRAN sources might need an CRAN update prior to an initial sync.

1.0.0

October 17, 2018

• RStudio 1.0 is the first generally available release of the product. RStudio license terms, conditions, and limits apply. Contact sales@posit.co for more details.

• RStudio Package Manager can automatically track R packages in Git (including GitHub, Bitbucket, and GitLab). Tracking Git endpoints requires a valid installation and configuration of R. Private endpoints are supported using ssh-keys. See the Admin Guide for details.

• Improved messaging for CLI commands and CRAN sync operations.

• CRAN synchronization will not happen until a manual sync has occurred or a repository subscribes to a cran source or curated cran source.

• BREAKING: A sync schedule of 12:00 AM (server time) daily is now enabled by default. To only have manual syncs, configure a blank SyncSchedule in the [CRAN] configuration. See the Admin Guide for details.

0.7.0

September 4, 2018

• BREAKING: The new default minimum TLS version for the HTTPS listener is “1.1”, in compliance with PCI Data Security Standards. Previously, TLS 1.0 was enabled by default. Additionally, it is now possible to specify the minimum TLS version using the HTTPS.MinimumTLS configuration setting.

• Fixed a bug in which CPU usage of the rstudio-pm service would increase over time.

• Added a new configuration flag, HTTP.ForceSecure, that makes RStudio Package Manager set the Secure flag on all of its cookies. This provides extra security when running RStudio Package Manager behind a HTTPS-terminating proxy. HTTP.ForceSecure also sets the Strict-Transport-Security header on all web connections.

0.6.0.1

August 2, 2018

• Fixed a bug in which empty files were being served for packages.rds and packages.gz files in the /bin/ directory. This was causing problems in R versions 3.4.4 and greater when a user attempted to install more than one package.

0.6.0

July 31, 2018

• Added Usage Statistics for analyzing package downloads and package licenses over time.

• Compress (gzip) the packages and archive RDS files before serving them to clients.

• Added row.names to the packages RDS file.

• The CLI list sources output now includes source types.

• Added a CLI list command that outputs a tree of all repos and sources.

• Added a CLI fetch command to initial eager package fetching.

• The CLI now uploads local packages using multi-part uploads to the API. Only the CLI needs permission to read files you are uploading, and relative paths are supported.

• Added support for minor migrations for CRAN sources. Minor migrations are typically used for supplementing CRAN sources with additional metadata.

• Added the SystemRequirements and NeedsCompilation fields to CRAN sources.

• Improved the informational and error messages displayed during curated CRAN operations.

• Fixed a bug that resulted in reading the wrong package DESCRIPTION file in some CRAN packages that include DESCRIPTION files at multiple paths.

0.5.0

June 28, 2018

• BREAKING: RStudio Package Manager’s support for CRAN metadata was simplified. RStudio Package Manager now includes a single, default CRAN source and the fetch mode and sync schedules are defined server-wide in the configuration file. If you have existing CRAN sources, they will be dropped when upgrading. A new cran source will be created automatically. Use the CLI to subscribe existing repositories to the new cran source and to sync the new cran source. Example: If you had a repository named prod that subscribed to an CRAN source named cran-src, you will need to run: rspm subscribe --repo=prod --source=cran and rspm sync after upgrading.

• BREAKING: The CRANTimeout and FetchTimeout configuration properties have been moved to a new [CRAN] configuration section. If you included either of these two properties under your [Server] configuration section, you will need to move them to a new [CRAN] configuration section.

• RStudio Package Manager now includes curated CRAN sources, giving administrators the ability to host approved subsets of CRAN instead of taking an all-or-nothing approach. Administrators add packages, preview changes, and even perform dry runs before running updates. The admin guide contains examples and quick start guides.

• The [CRAN] configuration section now includes SyncSchedule and SyncMode settings. The SyncSchedule setting accepts a crontab format for scheduling synchronization of the CRAN source. The SyncMode setting defaults to lazy but can be configured as eager for eager package downloading. The sync schedule and mode were previously configured using the CLI.

• Admins can now edit source names, repository names, and repository descriptions using the edit CLI command.

• Added an [API] configuration section that includes the settings MaxApiResults and DefaultApiResultsLimit for configurable API result limits.

• Added documentation for air-gapped environments. See the Admin Guide for details.

• Eliminates external fonts in the UI.

• The activity page for a CRAN source now lists the historical date represented by a sync operation instead of the date the sync occurred.

• Removed the CLI sync-wait command and replaced it with a flag. You can now run rspm sync --wait instead.

• Better support for the URL property that appears in many CRAN package DESCRIPTION files. This property appears in CRAN packages as URL, Url, and url, which are all now supported.

• The package date for archived packages is now displayed in the UI.

• The CLI reorder command allows reordering source subscriptions for a repository. This allows you to change the priority for resolving conflicts when two sources include a package with the same name.

• Fixed a bug that prevented using the UI through a proxy that prepends a prefix to the RStudio Package Manager URL.

• Include Content-Length and Last-Modified headers when serving a package tarball.

• Support for Ubuntu 18.04.

• SUSE Enterprise Linux 12 SP3+ Support.

0.4.0

May 3, 2018

• BREAKING: Sources can no longer be hidden. Since repositories can subscribe and unsubscribe from sources (since 0.2.0), there is no need to hide sources. Sources that were previously hidden will no longer be hidden after upgrading to this release. If your repositories subscribed to hidden sources that should remain hidden, please unsubscribe those repositories from the hidden sources before upgrading.
• Added the ability to version and migrate CRAN sources. This allows RStudio Package Manager to replace outdated or flawed CRAN sources without losing transaction history.
• Added a /ping endpoint to allow services to more easily monitor the service’s status. It always responds with an empty JSON message and a 200 status code.
• Sources cannot be deleted when associated with any repositories. A repository’s source subscriptions and unsubscriptions are all recorded permanently. To preserve a repository’s immutable historical records, no sources that were ever associated with an existing repository may be deleted. If you need to delete a source, you must first delete any repositories that at any time subscribed to the source.

0.3.0

March 26, 2018

• BREAKING: This release incorporates major improvements to sources typed as cran. Packages in existing sources typed as cran will be removed when upgrading. Administrators should initiate synchronization for any sources typed as cran after upgrading.

• KNOWN BUG: When using an NFS share for [Server].DataDir, there can be delays of up to 60 seconds when initailly serving particular files including the PACKAGES files for a particular repository. When using the “lazy” sync mode with CRAN, this delay can also occur the first time a version of a package is served. This latency can be improved by shortening the length of time attributes are cached on your NFS clients (see the acdirmax and noac NFS mount options). We will work to resolve this latency in a subsequent release.

• Added support for multiple current versions of CRAN packages.

• Support synchronizing multiple CRAN checkpoints simultaneously. This greatly reduces the time to synchronize a CRAN source.

• CRAN checkpoints are cached to avoid redundant downloads. This greatly reduces the time to synchronize CRAN sources.

• Introduced better logging configuration options to provide helpful logging during CRAN synchronization without overwhelming logs. Also added trace-level synchronization logging.

• Added a sync-wait command to the CLI. This command lets you wait for synchronization to complete after you initiate a synchronization.

• The RStudio Package Manager service now manages its /var/run/rstudio-pm directory correctly to avoid missing domain socket files on operating systems that use temporary file systems for the /var/run directory.

• More consistently sort/order packages. Previous RStudio Package Manager releases ordered packages inconsistently when using PostgreSQL vs. SQLite.

• Sort archived packages by version in the RStudio Package Manager Web client.

• Fixed a bug that prevented package link (depends, imports, etc.) versions from being displayed in the RStudio Package Manager Web client.

• Added the ability to specify a description for repositories, which are displayed via the CLI and the UI.

0.2.0

January 29, 2018

• The RStudio Package Manager service now runs under an unprivileged account. By default, the service runs under the rstudio-pm account. See the admin guide appendix on changing the RunAs User if you need to adjust the service account.

• BREAKING: Upon upgrading, if you previously configured RStudio Package Manager with alternative data directories, cache directories, log files, or .gcfg locations, you will need to manually change ownership on these files/directories to the new rstudio-pm service account. See the admin guide appendix on changing the RunAs User for more information.

• BREAKING: The internal structure of Package Manager has changed. Repositories no longer contain packages directly, but instead repositories are composed of one or more “sources”. Sources are typed as either local or cran. See the admin guide for more details. Due to this change, upgrading to 0.2 will wipe all existing repositories. Administrators should recreate the repositories using the source + repo model. Any CRAN packages that were previously downloaded will be retained on the server and can be accessed after a new repository is configured. Local packages will need to be readded. Additionally, the cache directory, /var/lib/rstudio-pm/cache can be removed prior to upgrading to save disk space.

• BREAKING: The administrator command line interface (CLI) has been significantly refactored for easier use. Any scripts developed with the previous CLI should be rewritten. The new CLI does not require root. Instead, admins should be part of the rstudio-pm unix group. Instructions for changing the group are included in the admin guide.

• BREAKING: Package Manager now tracks the number of downloads for each package. To do so, a new database was added for storing metrics. Servers using Postgres will need to create a new database and populate the [Postgres].MetricsURL configuration option or disable metrics by setting [Server].MetricsEnabled = false. Servers using the SQLite database (the default) will not need to alter their configuration; a new database will be created alongside your existing one.

• The [Server].MetricsRetention configuration option specifies when to reap metrics that have expired.

• The Package Manager web interface displays additional information about packages, including prior archived versions.

• In version 0.1.0 users were prompted to name the repository RSPM. The new Overview page suggests naming the repository according to the repository name on Package Manager.

• A date parsing error that occurred when adding local packages was fixed.

• A number of bugs were fixed to properly sync CRAN packages including properly archiving prior package versions and correctly displaying the Depends, Suggests, and Imports fields.

0.1.0

November 20, 2017

• This is the initial alpha release of RStudio Package Manager.