[pull] master from JuliaLang:master

.git-blame-ignore-revs

@@ -0,0 +1,2 @@
+# ran runic on the code base
+a84228360d6cff568a55911733e830cdf1c492da

.github/dependabot.yml

@@ -0,0 +1,11 @@
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "weekly"
+    groups:
+      all-actions:
+        patterns:
+          - "*"

.github/workflows/check.yml

@@ -0,0 +1,30 @@
+name: Code checks
+
+on:
+  pull_request:
+  push:
+    branches: ["master"]
+
+jobs:
+
+  pre-commit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
+        env:
+          # Skip runic-pre-commit since we use runic-action below instead
+          SKIP: runic
+
+  runic:
+    name: "Runic"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: julia-actions/setup-julia@v2
+        with:
+          version: '1.11'
+      - uses: julia-actions/cache@v2
+      - uses: fredrikekre/runic-action@v1
+        with:
+          version: "1.4" # Keep version in sync with .pre-commit-config.yaml

.github/workflows/test.yml

@@ -4,10 +4,12 @@ on:
     branches:
       - 'master'
       - 'release-*'
+      - 'backports-release-*'
   push:
     branches:
       - 'master'
       - 'release-*'
+      - 'backports-release-*'
     tags: '*'
 defaults:
   run:
@@ -71,6 +73,7 @@ jobs:
       - uses: julia-actions/julia-runtest@v1
         with:
           coverage: true
+          depwarn: error
         env:
           JULIA_PKG_SERVER: ${{ matrix.pkg-server }}
           JULIA_TEST_VERBOSE_LOGS_DIR: ${{ github.workspace }}
@@ -82,9 +85,10 @@ jobs:
       - uses: julia-actions/julia-processcoverage@v1
         env:
             JULIA_PKG_SERVER: ${{ matrix.pkg-server }}
-      - uses: codecov/codecov-action@v3
+      - uses: codecov/codecov-action@v5
         with:
-          file: lcov.info
+          files: lcov.info
+          token: ${{ secrets.CODECOV_TOKEN }}
   docs:
     runs-on: ubuntu-latest
     timeout-minutes: 60

.pre-commit-config.yaml

@@ -0,0 +1,17 @@
+repos:
+  - repo: 'https://github.com/pre-commit/pre-commit-hooks'
+    rev: v5.0.0
+    hooks:
+      - id: check-added-large-files
+      - id: check-case-conflict
+      # - id: check-toml # we have tomls with invalid syntax for tests
+      - id: check-yaml
+      - id: end-of-file-fixer
+      - id: mixed-line-ending
+      - id: trailing-whitespace
+  - repo: 'https://github.com/fredrikekre/runic-pre-commit'
+    rev: v2.0.1
+    hooks:
+      - id: runic
+        additional_dependencies:
+          - '[email protected]' # Keep version in sync with .github/workflows/Check.yml

CHANGELOG.md

@@ -1,9 +1,69 @@
+Pkg v1.13 Release Notes
+=======================
+
+- Project.toml environments now support a `readonly` field to mark environments as read-only, preventing modifications.
+  ([#4284])
+- `Pkg.build` now supports an `allow_reresolve` keyword argument to control whether the build process can re-resolve
+  package versions, similar to the existing option for `Pkg.test`. ([#3329])
+- Packages are now automatically added to `[sources]` when they are added by url or devved. ([#4225])
+- `update` now shows a helpful tip when trying to upgrade a specific package that can be upgraded but is held back
+  because it's part of a less optimal resolver solution ([#4266])
+- `Pkg.status` now displays yanked packages with a `[yanked]` indicator and shows a warning when yanked packages are
+  present. `Pkg.resolve` errors also display warnings about yanked packages that are not resolvable. ([#4310])
+- Added `pkg> compat --current` command to automatically populate missing compat entries with the currently resolved
+  package versions. Use `pkg> compat --current` for all packages or `pkg> compat Foo --current` for specific packages.
+  ([#3266])
+- Added `Pkg.precompile() do` block syntax to delay autoprecompilation until after multiple operations complete,
+  improving efficiency when performing several environment changes. ([#4262])
+- Added `Pkg.autoprecompilation_enabled(state::Bool)` to globally enable or disable automatic precompilation for Pkg
+  operations. ([#4262])
+- Implemented atomic TOML writes to prevent data corruption when Pkg operations are interrupted or multiple processes
+  write simultaneously. All TOML files are now written atomically using temporary files and atomic moves. ([#4293])
+- Implemented lazy loading for RegistryInstance to significantly improve startup performance for operations that don't
+  require full registry data. This reduces `Pkg.instantiate()` time by approximately 60% in many cases. ([#4304])
+- Added support for directly adding git submodules via `Pkg.add(path="/path/to/git-submodule.jl")`. ([#3344])
+- Enhanced REPL user experience by automatically detecting and stripping accidental leading `]` characters in commands.
+  ([#3122])
+- Improved tip messages to show REPL mode syntax when operating in REPL mode. ([#3854])
+- Enhanced error handling with more descriptive error messages when operations fail on empty URLs during git repository
+  installation or registry discovery. ([#4282])
+- Improved error messages for invalid compat entries to provide better guidance for fixing them. ([#4302])
+- Added warnings when attempting to add local paths that contain dirty git repositories. ([#4309])
+- Enhanced package parsing to better handle complex URLs and paths with branch/tag/subdir specifiers. ([#4299])
+- Improved artifact download behavior to only attempt downloads from the Pkg server when the package is registered on
+  that server's registries. ([#4297])
+- Added comprehensive documentation page about depots, including depot layouts and configuration. ([#2245])
+- Enhanced error handling for packages missing from registries or manifests with more informative messages. ([#4303])
+- Added more robust error handling when packages have revisions but no source information. ([#4311])
+- Enhanced registry status reporting with more detailed information. ([#4300])
+- Fixed various edge cases in package resolution and manifest handling. ([#4307], [#4308], [#4312])
+- Improved handling of path separators across different operating systems. ([#4305])
+- Added better error messages when accessing private PackageSpec.repo field. ([#4170])
+
 Pkg v1.12 Release Notes
 =======================
 
 - Pkg now has support for "workspaces" which is a way to resolve multiple project files into a single manifest.
-  The functions `Pkg.status`, `Pkg.why`, `Pkg.instantiate`, `Pkg.precompile` (and their REPL variants) have been updated
-  to take a `workspace` option. Read more about this feature in the manual about the TOML-files.
+  The functions `Pkg.status`, `Pkg.why`, `Pkg.instantiate`, `Pkg.precompile` (and their REPL variants) have been
+  updated to take a `workspace` option, with fixes for workspace path collection and package resolution in workspace
+  environments. Read more about this feature in the manual about the TOML-files. ([#3841], [#4229])
+- Pkg now supports "apps" which are Julia packages that can be run directly from the terminal after installation.
+  Apps can be defined in a package's Project.toml and installed via Pkg. Apps now support multiple apps per package
+  via submodules, allowing packages to define multiple command-line applications, with enhanced functionality including
+  update capabilities and better handling of already installed apps. ([#3772], [#4277], [#4263])
+- `status` now shows when different versions/sources of dependencies are loaded than that which is expected by the
+  manifest ([#4109])
+- When adding or developing a package that exists in the `[weakdeps]` section, it is now automatically removed from
+  weak dependencies and added as a regular dependency. ([#3865])
+- Enhanced fuzzy matching algorithm for package name suggestions with improved multi-factor scoring for better package
+  name suggestions. ([#4287])
+- The Pkg REPL now supports GitHub pull request URLs, allowing direct package installation from PRs via
+  `pkg> add https://github.com/Org/Package.jl/pull/123` ([#4295])
+- Improved git repository cloning performance by changing from `refs/*` to `refs/heads/*` to speed up operations on
+  repositories with many branches. ([#2330])
+- Improved REPL command parsing to handle leading whitespace with comma-separated packages. ([#4274])
+- Improved error messages when providing incorrect package UUIDs. ([#4270])
+- Added confirmation prompts before removing compat entries to prevent accidental deletions. ([#4254])
 
 Pkg v1.11 Release Notes
 =======================
@@ -21,7 +81,7 @@ Pkg v1.10 Release Notes
 =======================
 
 Pkg v1.9 Release Notes
-=======================
+======================
 
 - New functionality: `Pkg.why` and `pkg> why` to show why a package is inside the environment (shows all "paths" to a package starting at the direct dependencies).
 - When code coverage tracking is enabled for `Pkg.test` the new path-specific code-coverage option is used to limit coverage
@@ -83,6 +143,16 @@ Pkg v1.7 Release Notes
 - The `mode` keyword for `PackageSpec` has been removed ([#2454]).
 
 <!--- Generated by NEWS-update.jl --->
+[#4225]: https://github.com/JuliaLang/Pkg.jl/issues/4225
+[#4284]: https://github.com/JuliaLang/Pkg.jl/issues/4284
+[#3526]: https://github.com/JuliaLang/Pkg.jl/issues/3526
+[#3708]: https://github.com/JuliaLang/Pkg.jl/issues/3708
+[#3732]: https://github.com/JuliaLang/Pkg.jl/issues/3732
+[#3772]: https://github.com/JuliaLang/Pkg.jl/issues/3772
+[#3783]: https://github.com/JuliaLang/Pkg.jl/issues/3783
+[#3841]: https://github.com/JuliaLang/Pkg.jl/issues/3841
+[#3865]: https://github.com/JuliaLang/Pkg.jl/issues/3865
+[#4109]: https://github.com/JuliaLang/Pkg.jl/issues/4109
 [#2284]: https://github.com/JuliaLang/Pkg.jl/issues/2284
 [#2431]: https://github.com/JuliaLang/Pkg.jl/issues/2431
 [#2432]: https://github.com/JuliaLang/Pkg.jl/issues/2432
@@ -101,3 +171,36 @@ Pkg v1.7 Release Notes
 [#2995]: https://github.com/JuliaLang/Pkg.jl/issues/2995
 [#3002]: https://github.com/JuliaLang/Pkg.jl/issues/3002
 [#3021]: https://github.com/JuliaLang/Pkg.jl/issues/3021
+[#3266]: https://github.com/JuliaLang/Pkg.jl/pull/3266
+[#4266]: https://github.com/JuliaLang/Pkg.jl/pull/4266
+[#4310]: https://github.com/JuliaLang/Pkg.jl/pull/4310
+[#3329]: https://github.com/JuliaLang/Pkg.jl/pull/3329
+[#4262]: https://github.com/JuliaLang/Pkg.jl/pull/4262
+[#4293]: https://github.com/JuliaLang/Pkg.jl/pull/4293
+[#4304]: https://github.com/JuliaLang/Pkg.jl/pull/4304
+[#3344]: https://github.com/JuliaLang/Pkg.jl/pull/3344
+[#2330]: https://github.com/JuliaLang/Pkg.jl/pull/2330
+[#3122]: https://github.com/JuliaLang/Pkg.jl/pull/3122
+[#3854]: https://github.com/JuliaLang/Pkg.jl/pull/3854
+[#4282]: https://github.com/JuliaLang/Pkg.jl/pull/4282
+[#4302]: https://github.com/JuliaLang/Pkg.jl/pull/4302
+[#4309]: https://github.com/JuliaLang/Pkg.jl/pull/4309
+[#4299]: https://github.com/JuliaLang/Pkg.jl/pull/4299
+[#4295]: https://github.com/JuliaLang/Pkg.jl/pull/4295
+[#4277]: https://github.com/JuliaLang/Pkg.jl/pull/4277
+[#4297]: https://github.com/JuliaLang/Pkg.jl/pull/4297
+[#2245]: https://github.com/JuliaLang/Pkg.jl/pull/2245
+[#4303]: https://github.com/JuliaLang/Pkg.jl/pull/4303
+[#4254]: https://github.com/JuliaLang/Pkg.jl/pull/4254
+[#4270]: https://github.com/JuliaLang/Pkg.jl/pull/4270
+[#4263]: https://github.com/JuliaLang/Pkg.jl/pull/4263
+[#4229]: https://github.com/JuliaLang/Pkg.jl/pull/4229
+[#4274]: https://github.com/JuliaLang/Pkg.jl/pull/4274
+[#4311]: https://github.com/JuliaLang/Pkg.jl/pull/4311
+[#4300]: https://github.com/JuliaLang/Pkg.jl/pull/4300
+[#4307]: https://github.com/JuliaLang/Pkg.jl/pull/4307
+[#4308]: https://github.com/JuliaLang/Pkg.jl/pull/4308
+[#4312]: https://github.com/JuliaLang/Pkg.jl/pull/4312
+[#4305]: https://github.com/JuliaLang/Pkg.jl/pull/4305
+[#4170]: https://github.com/JuliaLang/Pkg.jl/pull/4170
+[#4287]: https://github.com/JuliaLang/Pkg.jl/pull/4287

Project.toml

@@ -3,7 +3,7 @@ uuid = "44cfe95a-1eb2-52ea-b672-e2afdf69b78f"
 keywords = ["package management"]
 license = "MIT"
 desc = "The next-generation Julia package manager."
-version = "1.12.0"
+version = "1.13.0"
 
 [workspace]
 projects = ["test", "docs"]
@@ -32,4 +32,20 @@ REPL = "3fa0cd96-eef1-5676-8a61-b3b8758bbffb"
 REPLExt = "REPL"
 
 [compat]
+Artifacts = "1.11"
+Dates = "1.11"
+Downloads = "1.6"
+FileWatching = "1.11"
+LibGit2 = "1.11"
+Libdl = "1.11"
+Logging = "1.11"
+Markdown = "1.11"
+Printf = "1.11"
+Random = "1.11"
+REPL = "1.11"
+SHA = "0.7"
+TOML = "1"
+Tar = "1.10"
+UUIDs = "1.11"
 julia = "1.12"
+p7zip_jll = "17.5"

README.md

@@ -13,12 +13,29 @@ If you want to develop this package do the following steps:
 - Make a fork and then clone the repo locally on your computer
 - Change the current directory to the Pkg repo you just cloned and start julia with `julia --project`.
 - `import Pkg` will now load the files in the cloned repo instead of the Pkg stdlib.
-- To test your changes, simply do `include("test/runtests.jl")`.
+- To test your changes, simply do `Pkg.test()`.
 
 If you need to build Julia from source with a Git checkout of Pkg, then instead use `make DEPS_GIT=Pkg` when building Julia. The `Pkg` repo is in `stdlib/Pkg`, and created initially with a detached `HEAD`. If you're doing this from a pre-existing Julia repository, you may need to `make clean` beforehand.
 
 If you need to build Julia from source with Git checkouts of two or more stdlibs, please see the instructions in the [`Building Julia from source with a Git checkout of a stdlib`](https://github.com/JuliaLang/julia/blob/master/doc/src/devdocs/build/build.md#building-julia-from-source-with-a-git-checkout-of-a-stdlib) section of the [`doc/src/devdocs/build/build.md`](https://github.com/JuliaLang/julia/blob/master/doc/src/devdocs/build/build.md) file within the Julia devdocs.
 
+## Pre-commit hooks
+
+This repository uses pre-commit hooks to automatically check and format code before commits. The hooks perform various checks including:
+
+- File size and case conflict validation
+- YAML syntax checking
+- Trailing whitespace removal and line ending fixes
+- Julia code formatting with Runic
+
+To install and use the pre-commit hooks:
+
+1. Install pre-commit: `pip install pre-commit` (or use your system's package manager)
+2. Install the hooks: `pre-commit install` from the root of the repository
+3. Run on all files: `pre-commit run --all-files` from the root of the repository
+
+Once installed, the hooks will run automatically on each commit. You can also run them manually anytime with `pre-commit run`.
+
 ## Synchronization with the Julia repo
 
 To check which commit julia master uses see [JuliaLang/julia/stdlib/Pkg.version](https://github.com/JuliaLang/julia/blob/master/stdlib/Pkg.version).

contrib/list_missing_pkg_tags.jl

@@ -0,0 +1,89 @@
+using LibGit2
+
+const JULIA_REPO_URL = "https://github.com/JuliaLang/julia.git"
+const JULIA_REPO_DIR = "julia"
+const PKG_VERSION_PATH = "stdlib/Pkg.version"
+const PKG_REPO_URL = "https://github.com/JuliaLang/Pkg.jl.git"
+const PKG_REPO_DIR = "Pkg.jl"
+
+function checkout_or_update_repo(url, dir)
+    return if isdir(dir)
+        println("Updating existing repository: $dir")
+        repo = LibGit2.GitRepo(dir)
+        LibGit2.fetch(repo)
+    else
+        println("Cloning repository: $url")
+        LibGit2.clone(url, dir)
+    end
+end
+
+function get_tags(repo)
+    refs = LibGit2.ref_list(repo)
+    tags = filter(ref -> startswith(ref, "refs/tags/"), refs)
+    return sort!(replace.(tags, "refs/tags/" => ""))
+end
+
+function is_stable_v1_release(tag)
+    return occursin(r"^v\d+\.\d+\.\d+$", tag) && VersionNumber(tag) >= v"1.0.0"
+end
+
+function extract_pkg_sha1(text::AbstractString)
+    m = match(r"PKG_SHA1\s*=\s*([a-f0-9]{40})", text)
+    return m !== nothing ? m[1] : nothing
+end
+
+function get_commit_hash_for_pkg_version(repo, tag)
+    return try
+        tag_ref = LibGit2.GitReference(repo, "refs/tags/" * tag)
+        LibGit2.checkout!(repo, string(LibGit2.GitHash(LibGit2.peel(tag_ref))))
+        version_file = joinpath(JULIA_REPO_DIR, PKG_VERSION_PATH)
+        if isfile(version_file)
+            return extract_pkg_sha1(readchomp(version_file))
+        else
+            println("Warning: Pkg.version file missing for tag $tag")
+            return nothing
+        end
+    catch
+        println("Error processing tag $tag")
+        rethrow()
+    end
+end
+
+tempdir = mktempdir()
+cd(tempdir) do
+    # Update Julia repo
+    checkout_or_update_repo(JULIA_REPO_URL, JULIA_REPO_DIR)
+    julia_repo = LibGit2.GitRepo(JULIA_REPO_DIR)
+
+    # Get Julia tags, filtering only stable releases
+    julia_tags = filter(is_stable_v1_release, get_tags(julia_repo))
+    version_commit_map = Dict{String, String}()
+
+    for tag in julia_tags
+        println("Processing Julia tag: $tag")
+        commit_hash = get_commit_hash_for_pkg_version(julia_repo, tag)
+        if commit_hash !== nothing
+            version_commit_map[tag] = commit_hash
+        end
+    end
+
+    # Update Pkg.jl repo
+    checkout_or_update_repo(PKG_REPO_URL, PKG_REPO_DIR)
+    pkg_repo = LibGit2.GitRepo(PKG_REPO_DIR)
+
+    # Get existing tags in Pkg.jl
+    pkg_tags = Set(get_tags(pkg_repo))
+
+    # Filter out versions that already exist
+    missing_versions = filter(v -> v ∉ pkg_tags, collect(keys(version_commit_map)))
+
+    # Sort versions numerically
+    sort!(missing_versions, by = VersionNumber)
+
+    # Generate `git tag` commands
+    println("\nGit tag commands for missing Pkg.jl versions:")
+    for version in missing_versions
+        commit = version_commit_map[version]
+        println("git tag $version $commit")
+    end
+end

docs/NEWS-update.jl

@@ -7,11 +7,11 @@ s = read(NEWS, String)
 
 m = match(r"\[#[0-9]+\]:", s)
 if m !== nothing
-    s = s[1:m.offset-1]
+    s = s[1:(m.offset - 1)]
 end
 
 footnote(n) = "[#$n]: https://github.com/JuliaLang/Pkg.jl/issues/$n"
-N = map(m -> parse(Int,m.captures[1]), eachmatch(r"\[#([0-9]+)\]", s))
+N = map(m -> parse(Int, m.captures[1]), eachmatch(r"\[#([0-9]+)\]", s))
 foots = join(map(footnote, sort!(unique(N))), "\n")
 
 open(NEWS, "w") do f