Result of renv::update(lock = TRUE) differs from renv::update(lock = FALSE); renv::snapshot()

[salim-b]

renv 1.0.6 introduced a lock parameter to renv::update() via 3c13647, implementing #1849 (thanks again!).

I just tested this new parameter for the first time and noticed it suffers from a similar issue as #1828:

When I run (in a project using renv's explicit snapshot type)

renv::update(prompt = FALSE, lock = TRUE)

it produces the following output

- Checking for updated packages ... Done!
The following package(s) will be updated:

# CRAN -----------------------------------------------------------------------
- spatial   [7.3-15 -> 7.3-17]

The following package(s) will be installed:
- spatial [7.3-17]
These packages will be installed into "~/Arbeit/ZDA/Git/zdaarau/fokus_reports/input/renv/library/R-4.3/x86_64-pc-linux-gnu".

# Installing packages --------------------------------------------------------
- Installing spatial ...                        OK [linked from cache]
Successfully installed 1 package in 16 milliseconds.
- Lockfile written to "~/Arbeit/ZDA/Git/zdaarau/fokus_reports/input/renv/renv.lock".

and renv writes the following lines to my project's renv.lock

    "spatial": {
      "Package": "spatial",
      "Version": "7.3-17",
      "Source": "Repository",
      "Repository": "RSPM",
      "Requirements": [
        "R",
        "graphics",
        "stats",
        "utils"
      ],
      "Hash": "1229a01b4ec059e9f2396724f2ec9010"
    },

although package spatial is neither a direct, nor indirect project dependency, i.e. it is not listed in my project's DESCRIPTION file, nor is it a required dependency of any other listed package. This results in the project being "out-of-sync" (until I manually revert the lockfile addition above). renv::status() at this point outputs

The following package(s) are in an inconsistent state:

 package installed recorded used
 spatial y         y        n   

See ?renv::status() for advice on resolving these issues.

---

When I OTOH run

renv::update(prompt = FALSE)
renv::snapshot(prompt = FALSE)

it produces the following output (which is exactly the same as above)

- Checking for updated packages ... Done!
The following package(s) will be updated:

# CRAN -----------------------------------------------------------------------
- spatial   [7.3-15 -> 7.3-17]

The following package(s) will be installed:
- spatial [7.3-17]
These packages will be installed into "~/Arbeit/ZDA/Git/zdaarau/fokus_reports/input/renv/library/R-4.3/x86_64-pc-linux-gnu".

# Installing packages --------------------------------------------------------
- Installing spatial ...                        OK [linked from cache]
Successfully installed 1 package in 16 milliseconds.

- Lockfile written to "~/Arbeit/ZDA/Git/zdaarau/fokus_reports/input/renv/renv.lock".

but renv does not alter my project's lockfile and everything is fine afterwards.

---

The project I'm testing this with is public, you can reproduce the above with

git clone https://gitlab.com/zdaarau/fokus_reports.git
cd fokus_reports/input/
R

and then

renv::restore()

After this, the project should be in consistent state and running either renv::update(prompt = FALSE, lock = TRUE) or renv::update(prompt = FALSE); renv::snapshot(prompt = FALSE) should reproduce what I reported above.