Julia Pkg

ID

julia

Home page

https://julialang.org

Platforms

🐧 Linux · 🍎 macOS · 🪟 Windows

Operations

installed · outdated · install · upgrade · upgrade_all · remove · sync

purl types

pkg:julia

CLI name

julia

Every call

julia --startup-file=no <command>

Issues and PRs

📦 manager: julia

Source

meta_package_manager/managers/julia.toml

Julia’s built-in package manager, Pkg, driven headlessly (https://julialang.org).

A package is a name from a registry, General being installed on first use, and every verb takes that name. Not to be confused with juliaup, which manages Julia versions where this manages the packages one Julia installs.

Every operation is one julia -e form, so the commands and the patterns below are written together.

Parsing notes, verified against Julia 1.12.7 on macOS:

  • The scope is the default environment, ~/.julia/environments/v<major>.<minor>, which is user-wide rather than tied to a directory. Julia does not activate a project from the working directory on its own, so the reading is stable, but JULIA_PROJECT and --project both override it. Nothing is forced against them: a user who sets that variable means it.

  • --startup-file=no is forced so a user’s startup.jl cannot activate a different environment, or print into the output being parsed.

  • The listing prefixes a package with ⌃ when a newer version exists and appends an Info line explaining the marker, so the pattern anchors on the UUID in brackets rather than on the start of the line. That is also what rejects the Status header and the Info footer.

  • Pkg.update restricts itself to the package it is given, checked against a name that is not installed rather than assumed: it exits 1 and upgrades nothing, where pamac and pkgm silently upgrade everything.

  • No search: Pkg resolves names against its registries but exposes no query over them.

Note

An empty environment prints Status ... (empty project) and exits 0, so an empty inventory is honest rather than a failure.

What mpm adds to julia

mpm reaches across every manager at once, not julia alone: mpm installed and mpm outdated cover julia alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your julia commands, in mpm

You already know julia: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…

With julia

With mpm

List what’s installed

julia -e using Pkg; Pkg.status()

mpm --julia installed

List outdated packages

julia -e using Pkg; Pkg.status(outdated=true)

mpm --julia outdated

Install a package

julia -e using Pkg; Pkg.add("<package_id>")

mpm install pkg:julia/<pkg>

Upgrade one package

julia -e using Pkg; Pkg.update("<package_id>")

mpm --julia upgrade <pkg>

Upgrade everything

julia -e using Pkg; Pkg.update()

mpm --julia upgrade --all

Remove a package

julia -e using Pkg; Pkg.rm("<package_id>")

mpm remove pkg:julia/<pkg>

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation

Supported

installed

✓

outdated

✓

orphans

search

install

✓

upgrade

✓

upgrade_all

✓

remove

✓

sync

✓

cleanup

doctor

Selecting and configuring julia

Deselect julia for a single run with --no-julia, or persist the choice in your configuration:

[mpm]
julia = false

The arguments and environment variables listed in the box atop this page are forced on every julia call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.julia]
timeout = 900

mpm config-template julia prints every overridable attribute as a ready-to-paste block.

Recipes

A few jobs you would otherwise script around julia, one mpm command each:

  • Snapshot and clone a machine: mpm --julia dump julia.toml, then mpm restore julia.toml on the next one.

  • Export a compliance SBOM: mpm --julia sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations needs root.

See privilege escalation for the full policy.

Cooldown

State of Julia Pkg’s release-age gating, from the cooldown support table:

Status: ❌ None (registry entries carry versions and hashes, never dates)

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

  • Registry: Julia General registry

  • Retraction: Yank: a registered version is withdrawn by a pull request against the registry marking it yanked, the sources staying wherever they were published

  • Publish date: ❌ a registry entry records a version, a tree hash and its dependencies, with no publication date

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Version probe

The version is probed by running:

$ julia --version
julia version 1.12.7

and extracted with:

r"julia\s+version\s+(?P<version>\S+)"

Reference traces

Raw native outputs captured in the bundled definition: the reference mpm’s parsers were written against. If you know Julia Pkg well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ julia -e using Pkg; Pkg.status()
Status `/tmp/mpm-drive/.julia/environments/v1.12/Project.toml`
⌃ [7876af07] Example v0.5.4
Info Packages marked with ⌃ have new versions available and may be upgradable.

$ julia -e using Pkg; Pkg.status(outdated=true)
Status `/tmp/mpm-drive/.julia/environments/v1.12/Project.toml`
⌃ [7876af07] Example v0.5.4 (<v0.5.5)

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --julia installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog

  • 8.0.0.dev0 (unreleased)

    • Add Julia Pkg package manager, with inventory, outdated, install, remove, upgrade and registry refresh.