attachment

• att_from_rscript() (and therefore att_amend_desc()) no longer reports a variable name as a package name. requireNamespace(), loadNamespace() and the ns argument of getFromNamespace() take a character string, so a bare symbol there can only be a variable holding the name, never the name itself; the same goes for library() and require() when the call passes character.only = TRUE. A guard such as for (pkg in c("callr", "jsonlite")) requireNamespace(pkg, quietly = TRUE) used to add a package literally called pkg to DESCRIPTION, which then stopped every renv / pak install on a package that cannot exist. A symbol is still read as the package name for library(), require() and use(), which compute on the unevaluated argument (#143).
• Named arguments of a dependency-introducing call are now matched the way R matches them, by exact name first and then by a prefix unambiguous among the formals, instead of by string equality. An abbreviated but perfectly legal spelling of the flag, library(pkgvar, char = TRUE), went unrecognised and added a package named after the variable; and an abbreviated package argument, library(pack = "jsonlite"), was missed altogether. The formals are read from the running R rather than written down here, and a formal placed after ... is matched by its exact name only, which is R's own rule (#143).
• att_amend_desc() no longer lets an Enhances version constraint override the Imports one for the same package. The rule that picks a version when a package is pinned under two types ordered the type as text, and "Enhances" sorts before "Imports", so Enhances: pkg (>= 9.9.9) replaced Imports: pkg (>= 2.0.0) and wrote a bound nobody had set for that type, which can make a package uninstallable. The precedence is now named explicitly, strongest first: Imports, Depends, LinkingTo, Suggests, Enhances.
• att_amend_desc() no longer counts a removal twice, nor names the package twice, when DESCRIPTION lists it under two dependency types. The list read by the comparison holds one row per (type, package) pair, so a package pinned under both Imports and Suggests produced [-] 2 package(s) removed: pkgA, pkgA for a single removal.

New features

• att_amend_desc() never drops a version constraint set by hand in DESCRIPTION. A package that no scanned source mentions used to be removed and its constraint to go with it, and a package listed in pkg_ignore used to be removed too, although pkg_ignore means "do not infer this from code" and not "delete what I wrote". Such an entry is now kept as declared, with its type and its version, and reported so the decision is visible. Widening dir.r makes it a detected dependency again; removing its constraint lets it go. A **bare** entry, with no version, is still removed: there is nothing to lose, and pkg_ignore stays usable for cleaning a wrong entry out. An Imports kept this way while no code uses it draws All declared Imports should be used from R CMD check, which reports a real defect of the package being amended that dropping the pin used to conceal (#139).

Maintenance

• The test suite reads lockfiles with renv::lockfile_read() instead of reaching into renv with getFromNamespace("lockfile", "renv"), which stopped working when renv 1.2.4 changed that internal. renv moves from Suggests: renv (>= 0.8.4) to renv (>= 1.0.0), the version that introduced the public lockfile functions.