Prepare 0.31.1 release

Closes #1472

Co-authored-by: Islon Scherer <i_desouzascherer@apple.com>

.github/PklProject

@@ -2,7 +2,7 @@ amends "pkl:Project"
 
 dependencies {
   ["pkl.impl.ghactions"] {
-    uri = "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.3.5"
+    uri = "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.5.0"
   }
   ["gha"] {
     uri = "package://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1.2.0"

.github/PklProject.deps.json

@@ -10,9 +10,9 @@
     },
     "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1": {
       "type": "remote",
-      "uri": "projectpackage://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.3.5",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.5.0",
       "checksums": {
-        "sha256": "2b26d02c3b244a28e7913457ba195cbf767a1d1079ab2ed469074c4da870de12"
+        "sha256": "2c1e0d9efcd65b3c3207bf535c325ebc0ec2ab169187b324c4bb70821cac0e51"
       }
     },
     "package://pkg.pkl-lang.org/pkl-pantry/pkl.experimental.deepToTyped@1": {

.github/jobs/BuildNativeJob.pkl

@@ -12,7 +12,7 @@ project: String
 extraGradleArgs {
   when (os == "macOS" && arch == "amd64") {
     "-Dpkl.targetArch=\(module.arch)"
-    "-Dpkl.native--native-compiler-path=\(context.github.workspace)/.github/scripts/cc_macos_amd64.sh"
+    #""-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh""#
   }
   when (musl) {
     "-Dpkl.musl=true"
@@ -40,7 +40,7 @@ steps {
     new {
       name = "Fix git ownership"
       // language=bash
-      run = "git status || git config --system --add safe.directory $GITHUB_WORKSPACE"
+      run = #"git status || git config --system --add safe.directory "$GITHUB_WORKSPACE""#
     }
   }
   new {

.github/jobs/GradleJob.pkl

@@ -90,7 +90,13 @@ fixed job {
             "aarch64"
       }
     }
-    catalog.`gradle/actions/setup-gradle@v5`
+    (catalog.`gradle/actions/setup-gradle@v5`) {
+      when (isRelease) {
+        with {
+          `cache-disabled` = true
+        }
+      }
+    }
     ...module.steps
   }
 }

.github/workflows/__lockfile__.yml

@@ -21,7 +21,7 @@ jobs:
     - name: actions/checkout@v6
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
     - name: actions/create-github-app-token@v2
-      uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
+      uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
     - name: actions/download-artifact@v6
       uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
     - name: actions/setup-java@v5
@@ -31,4 +31,4 @@ jobs:
     - name: dawidd6/action-download-artifact@v11
       uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # v11
     - name: gradle/actions/setup-gradle@v5
-      uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+      uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5

.github/workflows/build.yml

@@ -28,7 +28,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: check
       shell: bash
@@ -61,7 +61,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: check
       shell: bash
@@ -92,7 +92,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: bench:jmh
       shell: bash
@@ -111,7 +111,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
       shell: bash
@@ -143,7 +143,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
@@ -185,11 +185,11 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-cli:buildNative
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -223,10 +223,10 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -266,7 +266,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: gradle buildNative
       shell: bash
@@ -304,10 +304,10 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -344,7 +344,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: Install musl and zlib
       run: |
@@ -454,7 +454,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: gradle buildNative
       shell: bash
@@ -493,11 +493,11 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-doc:buildNative
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -531,10 +531,10 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -574,7 +574,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: gradle buildNative
       shell: bash
@@ -612,10 +612,10 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -652,7 +652,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: Install musl and zlib
       run: |
@@ -762,7 +762,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: gradle buildNative
       shell: bash

.github/workflows/main.yml

@@ -26,7 +26,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: check
       shell: bash
@@ -59,7 +59,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: check
       shell: bash
@@ -90,7 +90,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: bench:jmh
       shell: bash
@@ -109,7 +109,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
       shell: bash
@@ -141,7 +141,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
@@ -183,11 +183,11 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-cli:buildNative
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -221,10 +221,10 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -264,7 +264,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: gradle buildNative
       shell: bash
@@ -302,10 +302,10 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -342,7 +342,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: Install musl and zlib
       run: |
@@ -452,7 +452,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: gradle buildNative
       shell: bash
@@ -491,11 +491,11 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-doc:buildNative
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -529,10 +529,10 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -572,7 +572,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: gradle buildNative
       shell: bash
@@ -610,10 +610,10 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -650,7 +650,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: Install musl and zlib
       run: |
@@ -760,7 +760,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: gradle buildNative
       shell: bash
@@ -815,7 +815,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
@@ -896,7 +896,7 @@ jobs:
     steps:
     - name: Create app token
       id: app-token
-      uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
+      uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
       with:
         app-id: ${{ secrets.PKL_CI_CLIENT_ID }}
         private-key: ${{ secrets.PKL_CI }}
@@ -904,9 +904,10 @@ jobs:
     - name: Trigger pkl-lang.org build
       env:
         GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        SOURCE_RUN: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
       run: |-
         gh workflow run \
           --repo apple/pkl-lang.org \
           --ref main \
-          --field source_run="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+          --field source_run="${SOURCE_RUN}" \
           main.yml

.github/workflows/prb.yml

@@ -22,7 +22,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: check
       shell: bash
@@ -57,7 +57,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: check
       shell: bash
@@ -92,11 +92,11 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-cli:buildNative
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -132,10 +132,10 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -176,7 +176,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: gradle buildNative
       shell: bash
@@ -216,10 +216,10 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -258,7 +258,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: Install musl and zlib
       run: |
@@ -370,7 +370,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: gradle buildNative
       shell: bash
@@ -410,11 +410,11 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-doc:buildNative
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -450,10 +450,10 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -494,7 +494,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: gradle buildNative
       shell: bash
@@ -534,10 +534,10 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -576,7 +576,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: Install musl and zlib
       run: |
@@ -688,7 +688,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: gradle buildNative
       shell: bash

.github/workflows/release-branch.yml

@@ -26,7 +26,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: check
       shell: bash
@@ -59,7 +59,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: check
       shell: bash
@@ -90,7 +90,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: bench:jmh
       shell: bash
@@ -109,7 +109,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
       shell: bash
@@ -141,7 +141,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
@@ -183,11 +183,11 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-cli:buildNative
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -221,10 +221,10 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -264,7 +264,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: gradle buildNative
       shell: bash
@@ -302,10 +302,10 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -342,7 +342,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: Install musl and zlib
       run: |
@@ -452,7 +452,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: gradle buildNative
       shell: bash
@@ -491,11 +491,11 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-doc:buildNative
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -529,10 +529,10 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -572,7 +572,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: gradle buildNative
       shell: bash
@@ -610,10 +610,10 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -650,7 +650,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: Install musl and zlib
       run: |
@@ -760,7 +760,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: gradle buildNative
       shell: bash
@@ -847,7 +847,7 @@ jobs:
     steps:
     - name: Create app token
       id: app-token
-      uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
+      uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
       with:
         app-id: ${{ secrets.PKL_CI_CLIENT_ID }}
         private-key: ${{ secrets.PKL_CI }}
@@ -855,9 +855,10 @@ jobs:
     - name: Trigger pkl-lang.org build
       env:
         GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        SOURCE_RUN: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
       run: |-
         gh workflow run \
           --repo apple/pkl-lang.org \
           --ref main \
-          --field source_run="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+          --field source_run="${SOURCE_RUN}" \
           main.yml

.github/workflows/release.yml

@@ -26,7 +26,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: check
       shell: bash
@@ -59,7 +59,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: check
       shell: bash
@@ -90,7 +90,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: bench:jmh
       shell: bash
@@ -109,7 +109,7 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
     - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
       shell: bash
@@ -141,8 +141,9 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
+      with:
+        cache-disabled: true
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
         persist-credentials: false
@@ -183,11 +184,12 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
+      with:
+        cache-disabled: true
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-cli:buildNative
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -221,10 +223,11 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
+      with:
+        cache-disabled: true
     - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
@@ -264,8 +267,9 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
+      with:
+        cache-disabled: true
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
@@ -302,10 +306,11 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
+      with:
+        cache-disabled: true
     - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
@@ -342,8 +347,9 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
+      with:
+        cache-disabled: true
     - name: Install musl and zlib
       run: |
         set -e
@@ -452,8 +458,9 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
+      with:
+        cache-disabled: true
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
@@ -491,11 +498,12 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
+      with:
+        cache-disabled: true
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-doc:buildNative
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -529,10 +537,11 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
+      with:
+        cache-disabled: true
     - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
@@ -572,8 +581,9 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
+      with:
+        cache-disabled: true
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
@@ -610,10 +620,11 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
+      with:
+        cache-disabled: true
     - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
@@ -650,8 +661,9 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
+      with:
+        cache-disabled: true
     - name: Install musl and zlib
       run: |
         set -e
@@ -760,8 +772,9 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
+      with:
+        cache-disabled: true
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
@@ -815,8 +828,9 @@ jobs:
         java-version: '21'
         distribution: temurin
         architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
+      with:
+        cache-disabled: true
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
         persist-credentials: false
@@ -923,7 +937,7 @@ jobs:
     steps:
     - name: Create app token
       id: app-token
-      uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
+      uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
       with:
         app-id: ${{ secrets.PKL_CI_CLIENT_ID }}
         private-key: ${{ secrets.PKL_CI }}
@@ -931,9 +945,10 @@ jobs:
     - name: Trigger pkl-lang.org build
       env:
         GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        SOURCE_RUN: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
       run: |-
         gh workflow run \
           --repo apple/pkl-lang.org \
           --ref main \
-          --field source_run="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+          --field source_run="${SOURCE_RUN}" \
           main.yml

.idea/inspectionProfiles/Project_Default.xml

@@ -12,6 +12,27 @@
       <option name="REPORT_FIELDS" value="true" />
     </inspection_tool>
     <inspection_tool class="ClassCanBeRecord" enabled="false" level="WEAK WARNING" enabled_by_default="false" />
+    <inspection_tool class="CustomRegExpInspection" enabled="true" level="WARNING" enabled_by_default="true">
+      <option name="myConfigurations">
+        <list>
+          <RegExpInspectionConfiguration>
+            <option name="name" value="PklCliDirectProjectEvaluatorSettingsAccess" />
+            <option name="suppressId" value="PklCliDirectProjectEvaluatorSettingsAccess" />
+            <option name="uuid" value="dd497f47-d38f-3fab-9ed7-eabe699620c8" />
+            <option name="patterns">
+              <list>
+                <InspectionPattern>
+                  <option name="regExp" value="project\?\.evaluatorSettings" />
+                  <option name="_fileType" value="Kotlin" />
+                  <option name="searchContext" value="ANY" />
+                  <option name="replacement" value="evaluatorSettings" />
+                </InspectionPattern>
+              </list>
+            </option>
+          </RegExpInspectionConfiguration>
+        </list>
+      </option>
+    </inspection_tool>
     <inspection_tool class="FieldMayBeFinal" enabled="true" level="INFORMATION" enabled_by_default="true">
       <scope name="AllExceptTruffleAst" level="WARNING" enabled="true" />
     </inspection_tool>
@@ -73,5 +94,6 @@
       <option name="processLiterals" value="true" />
       <option name="processComments" value="true" />
     </inspection_tool>
+    <inspection_tool class="dd497f47-d38f-3fab-9ed7-eabe699620c8" enabled="true" level="ERROR" enabled_by_default="true" editorAttributes="ERRORS_ATTRIBUTES" />
   </profile>
 </component>

docs/antora.yml

@@ -1,6 +1,6 @@
 name: main
 title: Main Project
-version: 0.31.0-dev
+version: 0.31.1
-prerelease: true
+prerelease: false
 nav:
 - nav.adoc

docs/modules/ROOT/partials/component-attributes.adoc

@@ -3,10 +3,10 @@
 // the following attributes must be updated immediately before a release
 
 // pkl version corresponding to current git commit without -dev suffix or git hash
-:pkl-version-no-suffix: 0.31.0
+:pkl-version-no-suffix: 0.31.1
 // tells whether pkl version corresponding to current git commit
 // is a release version (:is-release-version: '') or dev version (:!is-release-version:)
-:!is-release-version:
+:is-release-version: ''
 
 // the remaining attributes do not need to be updated regularly
 

docs/modules/language-reference/pages/index.adoc

@@ -4922,7 +4922,7 @@ animals {
 ==== Receiver
 
 The receiver is the bottom-most object in the <<prototype-chain>>.
-That means that, within the context of an amending object, the reciever is the amending object.
+That means that, within the context of an amending object, the receiver is the amending object.
 
 Example:
 [source,pkl]

docs/modules/release-notes/pages/0.29.adoc

@@ -266,7 +266,7 @@ Thanks to https://github.com/gordonbondon[@gordonbondon] for contributing to thi
 
 === `@Generated` annotation for Java/Kotlin codegen
 
-Classes generated by the Java and Kotlin code generator can optionally recieve new annotation called `Generated` (https://github.com/apple/pkl/pull/1075[#1075], https://github.com/apple/pkl/pull/1115[#1115]).
+Classes generated by the Java and Kotlin code generator can optionally receive new annotation called `Generated` (https://github.com/apple/pkl/pull/1075[#1075], https://github.com/apple/pkl/pull/1115[#1115]).
 
 This behavior is toggled with the `--generated-annotation` CLI flag, or the similarly named Gradle property.
 

docs/modules/release-notes/pages/0.31.adoc

@@ -1,6 +1,6 @@
 = Pkl 0.31 Release Notes
 :version: 0.31
-:version-minor: 0.31.0
+:version-minor: 0.31.1
 :release-date: February 26th, 2026
 :version-next: 0.32
 :version-next-date: July 2026
@@ -55,7 +55,7 @@ Value: new Person { name = "Bub Johnson" }
 7 | passenger: Person(name.endsWith(lastName)) = new { name = "Bub Johnson" }
 ----
 
-Now, we know what the expecation actually is.
+Now, we know what the expectation is.
 
 This type of diagram is also added to test facts.
 When tests fail, Pkl emits a diagram of the expression, and the values produced.

docs/modules/release-notes/pages/changelog.adoc

@@ -1,10 +1,41 @@
 = Changelog
 include::ROOT:partial$component-attributes.adoc[]
 
+[[release-0.31.1]]
+== 0.31.1 (2026-03-26)
+
+=== Breaking Changes [small]#💔#
+
+* Allow nullable reads for custom/external resources (pr:https://github.com/apple/pkl/pull/1471[]).
+
+This allows custom/external resources to produce `null` values for xref:language-reference:index.adoc#nullable-reads[nullable reads] (`read?`).
+While this is a breaking change in behavior, it is currently not possible to exercise with versions of pkl-go or pkl-swift released prior to this change.
+
+=== Fixes
+
+* Fix typo in changelog and language reference (pr:https://github.com/apple/pkl/pull/1455[]).
+* Fix bugs in `CommandSpecParser` (pr:https://github.com/apple/pkl/pull/1448[], pr:https://github.com/apple/pkl/pull/1449[]).
+* Respect `--omit-project-settings` for all evaluator options (pr:https://github.com/apple/pkl/pull/1459[]).
+* Fix SecurityManager check for HTTP(S) module URIs (pr:https://github.com/apple/pkl/pull/1463[]).
+* Fix performance regression caused by activation of power assertion instrumentation during some union type checks (pr:https://github.com/apple/pkl/pull/1462[]).
+* Fix module reflection when power assertion instrumentation is active (pr:https://github.com/apple/pkl/pull/1464[]).
+* Prevent I/O when checking UNC paths against `--root-dir` (pr:https://github.com/apple/pkl/pull/1466[]).
+* Prevent `--multiple-file-output-path` writes from following symlinks outside the target directory
+(pr:https://github.com/apple/pkl/pull/1467[]).
+
+=== Contributors ❤️
+
+Thank you to all the contributors for this release!
+
+* https://github.com/04cb[@04cb]
+* https://github.com/HT154[@HT154]
+* https://github.com/KushalP[@KushalP]
+
 [[release-0.31.0]]
-== 0.31.0 (UNRELEASED)
+== 0.31.0 (2026-02-26)
 
 xref:0.31.adoc[Release Notes]
+
 [[release-0.30.2]]
 
 == 0.30.2 (2025-12-15)

gradle.properties

@@ -1,7 +1,7 @@
 # suppress inspection "UnusedProperty" for whole file
 
 group=org.pkl-lang
-version=0.31.0
+version=0.31.1
 
 # google-java-format requires jdk.compiler exports
 org.gradle.jvmargs= \

jbang-catalog.json

@@ -2,15 +2,15 @@
   "catalogs": {},
   "aliases": {
     "pkl": {
-      "script-ref": "org.pkl-lang:pkl-cli-java:0.30.2",
+      "script-ref": "org.pkl-lang:pkl-cli-java:0.31.1",
       "java-agents": []
     },
     "pkl-codegen-java": {
-      "script-ref": "org.pkl-lang:pkl-codegen-java:0.30.2",
+      "script-ref": "org.pkl-lang:pkl-codegen-java:0.31.1",
       "java-agents": []
     },
     "pkl-codegen-kotlin": {
-      "script-ref": "org.pkl-lang:pkl-codegen-kotlin:0.30.2",
+      "script-ref": "org.pkl-lang:pkl-codegen-kotlin:0.31.1",
       "java-agents": []
     }
   },

pkl-cli/src/main/kotlin/org/pkl/cli/CliEvaluator.kt

@@ -240,8 +240,7 @@ constructor(
 
       for ((pathSpec, fileOutput) in output) {
         checkPathSpec(pathSpec)
-        val resolvedPath = realOutputDir.resolve(pathSpec).normalize()
+        val (realPath, resolvedPath) = realOutputDir.resolveRealPath(Path.of(pathSpec))
-        val realPath = if (resolvedPath.exists()) resolvedPath.toRealPath() else resolvedPath
         if (!realPath.startsWith(realOutputDir)) {
           throw CliException(
             "Output file conflict: `output.files` entry `\"$pathSpec\"` in module `$moduleUri` resolves to file path `$realPath`, which is outside output directory `$realOutputDir`."
@@ -269,4 +268,22 @@ constructor(
       }
     }
   }
+
+  /**
+   * Resolves [rel] against this Path name-by-name. At each step, the real path is resolved if the
+   * file exists. The normalized real path and normalized resolved path are returned. This has a
+   * similar effect to `this.resolve(rel).toRealPath().normalize()`, but the real paths account for
+   * symlinks in the middle of the relative path so the full path need not exist.
+   */
+  private fun Path.resolveRealPath(rel: Path): Pair<Path, Path> {
+    assert(!rel.isAbsolute)
+    var resolved = this
+    var real = this
+    for (name in rel) {
+      resolved = resolved.resolve(name)
+      real = real.resolve(name)
+      if (real.exists()) real = real.toRealPath()
+    }
+    return real.normalize() to resolved.normalize()
+  }
 }

pkl-cli/src/test/kotlin/org/pkl/cli/CliEvaluatorTest.kt

@@ -931,6 +931,37 @@ result = someLib.x
       .hasMessageContaining("which is outside output directory")
   }
 
+  @Test
+  @DisabledOnOs(OS.WINDOWS)
+  fun `multiple file output throws if files are written outside the base path via symlink`() {
+    val output = tempDir.resolve(".output").createDirectories()
+    val outside = tempDir.resolve("outside").createDirectories()
+    output.resolve("outside").createSymbolicLinkPointingTo(outside)
+
+    val moduleUri =
+      writePklFile(
+        "test.pkl",
+        """
+        output {
+          files {
+            ["outside/foo.txt"] {
+              text = "bar"
+            }
+          }
+        }
+      """
+          .trimIndent(),
+      )
+    val options =
+      CliEvaluatorOptions(
+        CliBaseOptions(sourceModules = listOf(moduleUri), workingDir = tempDir),
+        multipleFileOutputPath = ".output",
+      )
+    assertThatCode { evalToConsole(options) }
+      .hasMessageStartingWith("Output file conflict:")
+      .hasMessageContaining("which is outside output directory")
+  }
+
   @Test
   fun `multiple file output throws if file path is a directory`() {
     tempDir.resolve(".output/myDir").createDirectories()

pkl-commons-cli/src/main/kotlin/org/pkl/commons/cli/CliCommand.kt

@@ -139,6 +139,7 @@ abstract class CliCommand(protected val cliOptions: CliBaseOptions) {
   }
 
   private val evaluatorSettings: PklEvaluatorSettings? by lazy {
+    @Suppress("PklCliDirectProjectEvaluatorSettingsAccess")
     if (cliOptions.omitProjectSettings) null else project?.evaluatorSettings
   }
 
@@ -199,34 +200,30 @@ abstract class CliCommand(protected val cliOptions: CliBaseOptions) {
     )
   }
 
-  protected val useColor: Boolean by lazy { cliOptions.color?.hasColor() ?: false }
+  protected val useColor: Boolean by lazy {
-
+    cliOptions.color?.hasColor() ?: evaluatorSettings?.color?.hasColor() ?: false
-  private val proxyAddress: URI? by lazy {
-    cliOptions.httpProxy
-      ?: project?.evaluatorSettings?.http?.proxy?.address
-      ?: settings.http?.proxy?.address
   }
 
-  private val noProxy: List<String>? by lazy {
+  protected val proxyAddress: URI? by lazy {
+    cliOptions.httpProxy ?: evaluatorSettings?.http?.proxy?.address ?: settings.http?.proxy?.address
+  }
+
+  protected val noProxy: List<String>? by lazy {
     cliOptions.httpNoProxy
-      ?: project?.evaluatorSettings?.http?.proxy?.noProxy
+      ?: evaluatorSettings?.http?.proxy?.noProxy
       ?: settings.http?.proxy?.noProxy
   }
 
-  private val httpRewrites: Map<URI, URI>? by lazy {
+  protected val httpRewrites: Map<URI, URI>? by lazy {
-    cliOptions.httpRewrites
+    cliOptions.httpRewrites ?: evaluatorSettings?.http?.rewrites ?: settings.http?.rewrites()
-      ?: project?.evaluatorSettings?.http?.rewrites
-      ?: settings.http?.rewrites()
   }
 
-  private val externalModuleReaders: Map<String, PklEvaluatorSettings.ExternalReader> by lazy {
+  protected val externalModuleReaders: Map<String, PklEvaluatorSettings.ExternalReader> by lazy {
-    (project?.evaluatorSettings?.externalModuleReaders ?: emptyMap()) +
+    (evaluatorSettings?.externalModuleReaders ?: emptyMap()) + cliOptions.externalModuleReaders
-      cliOptions.externalModuleReaders
   }
 
-  private val externalResourceReaders: Map<String, PklEvaluatorSettings.ExternalReader> by lazy {
+  protected val externalResourceReaders: Map<String, PklEvaluatorSettings.ExternalReader> by lazy {
-    (project?.evaluatorSettings?.externalResourceReaders ?: emptyMap()) +
+    (evaluatorSettings?.externalResourceReaders ?: emptyMap()) + cliOptions.externalResourceReaders
-      cliOptions.externalResourceReaders
   }
 
   private val externalProcesses:
@@ -240,7 +237,7 @@ abstract class CliCommand(protected val cliOptions: CliBaseOptions) {
   }
 
   private val traceMode: TraceMode by lazy {
-    cliOptions.traceMode ?: project?.evaluatorSettings?.traceMode ?: TraceMode.COMPACT
+    cliOptions.traceMode ?: evaluatorSettings?.traceMode ?: TraceMode.COMPACT
   }
 
   private fun HttpClient.Builder.addDefaultCliCertificates() {

pkl-commons-cli/src/test/kotlin/org/pkl/commons/cli/CliCommandTest.kt

@@ -16,6 +16,7 @@
 package org.pkl.commons.cli
 
 import com.github.ajalt.clikt.core.parse
+import com.github.ajalt.clikt.parameters.groups.provideDelegate
 import java.net.URI
 import java.nio.file.Path
 import kotlin.io.path.ExperimentalPathApi
@@ -25,26 +26,44 @@ import org.junit.jupiter.api.Test
 import org.junit.jupiter.api.assertThrows
 import org.junit.jupiter.api.io.TempDir
 import org.pkl.commons.cli.commands.BaseCommand
+import org.pkl.commons.cli.commands.ProjectOptions
+import org.pkl.commons.writeString
 import org.pkl.core.SecurityManagers
+import org.pkl.core.evaluatorSettings.TraceMode
+import org.pkl.core.util.IoUtils
 
 @OptIn(ExperimentalPathApi::class)
 class CliCommandTest {
 
-  class CliTest(options: CliBaseOptions) : CliCommand(options) {
-    override fun doRun() = Unit
-
-    val myAllowedResources = allowedResources
-    val myAllowedModules = allowedModules
-    val myResolvedSourceModules = resolvedSourceModules
-  }
-
   private val cmd =
     object : BaseCommand("test", "") {
+      val projectOptions: ProjectOptions by ProjectOptions()
+
       override fun run() = Unit
 
       override val helpString: String = ""
     }
 
+  class CliTest(options: CliBaseOptions) : CliCommand(options) {
+    override fun doRun() = Unit
+
+    val myResolvedSourceModules = resolvedSourceModules
+    val myAllowedModules = allowedModules
+    val myAllowedResources = allowedResources
+    val myRootDir = rootDir
+    val myModulePath = modulePath
+    val myProxyAddress = proxyAddress
+    val myNoProxy = noProxy
+    val myHttpRewrites = httpRewrites
+    val myExternalModuleReaders = externalModuleReaders
+    val myExternalResourceReaders = externalResourceReaders
+
+    fun myEvaluatorBuilder() = evaluatorBuilder()
+
+    @Suppress("PklCliDirectProjectEvaluatorSettingsAccess")
+    val myProjectEvaluatorSettings = project?.evaluatorSettings
+  }
+
   @Test
   fun `--external-resource-reader and --external-module-reader populate allowed modules and resources`() {
     cmd.parse(
@@ -184,4 +203,81 @@ class CliCommandTest {
     assertThat(cliTest.myResolvedSourceModules)
       .isEqualTo(listOf(tempDir.toUri().resolve("package://example.com/foo@1.2.3#/bar.pkl")))
   }
+
+  val projectWithAllEvaluatorSettings =
+    """
+    amends "pkl:Project"
+    
+    evaluatorSettings {
+      externalProperties { ["foo"] = "bar" }
+      env { ["foo"] = "bar" }
+      allowedModules { "file:" }
+      allowedResources { "file:" }
+      color = "always"
+      noCache = true
+      modulePath { "/tmp/modulepath" }
+      timeout = 30.s
+      moduleCacheDir = "/tmp/cache"
+      rootDir = "/tmp/root"
+      http {
+        proxy {
+          address = "http://example.com:80"
+          noProxy { "example.com" }
+        }
+        rewrites {
+          ["https://example.com/foo/"] = "https://example.com/bar/"
+        }
+      }
+      externalModuleReaders {
+        ["foo"] { executable = "foo" }
+      }
+      externalResourceReaders {
+        ["foo"] { executable = "foo" }
+      }
+      traceMode = "pretty"
+    }
+  """
+      .trimIndent()
+
+  @Test
+  fun `test that --omit-project-settings actually omits project settings`(@TempDir tempDir: Path) {
+    val project = tempDir.resolve("PklProject").writeString(projectWithAllEvaluatorSettings)
+    cmd.parse(arrayOf("--working-dir=$tempDir", "--omit-project-settings"))
+    val opts =
+      cmd.baseOptions.baseOptions(listOf(project.toUri()), cmd.projectOptions, testMode = true)
+    val cliTest = CliTest(opts)
+    val builder = cliTest.myEvaluatorBuilder()
+    assertThat(cliTest.myAllowedModules).isEqualTo(SecurityManagers.defaultAllowedModules)
+    assertThat(cliTest.myAllowedResources).isEqualTo(SecurityManagers.defaultAllowedResources)
+    assertThat(cliTest.myRootDir).isNull()
+    assertThat(builder.environmentVariables).isEqualTo(System.getenv())
+    assertThat(builder.externalProperties).isEmpty()
+    assertThat(builder.moduleCacheDir).isEqualTo(IoUtils.getDefaultModuleCacheDir())
+    assertThat(cliTest.myModulePath).isEmpty()
+    assertThat(builder.color).isFalse
+    assertThat(cliTest.myProxyAddress).isNull()
+    assertThat(cliTest.myNoProxy).isNull()
+    assertThat(cliTest.myHttpRewrites).isNull()
+    assertThat(cliTest.myExternalModuleReaders).isEmpty()
+    assertThat(cliTest.myExternalResourceReaders).isEmpty()
+    assertThat(builder.traceMode).isEqualTo(TraceMode.COMPACT)
+  }
+
+  // hygiene test to ensure new evaluator settings get covered by the above test
+  @Test
+  fun `test project sets all evaluator settings`(@TempDir tempDir: Path) {
+    val project = tempDir.resolve("PklProject").writeString(projectWithAllEvaluatorSettings)
+    cmd.parse(arrayOf("--working-dir=$tempDir"))
+    val opts = cmd.baseOptions.baseOptions(listOf(project.toUri()), testMode = true)
+    val cliTest = CliTest(opts)
+    cliTest.myProjectEvaluatorSettings
+      ?.javaClass
+      ?.declaredMethods
+      ?.filter { it.parameterCount == 0 }
+      ?.forEach {
+        assertThat(it.invoke(cliTest.myProjectEvaluatorSettings))
+          .overridingErrorMessage("project evaluator settings returned null for ${it.name}")
+          .isNotNull
+      }
+  }
 }

pkl-core/src/main/java/org/pkl/core/EvaluatorImpl.java

@@ -336,6 +336,16 @@ public final class EvaluatorImpl implements Evaluator {
     }
   }
 
+  // for use in tests to determine whether an evaluator ever triggered instrumentation
+  boolean isInstrumentationEverUsed() {
+    polyglotContext.enter();
+    try {
+      return VmLanguage.get(null).localContext.get().isInstrumentationEverUsed();
+    } finally {
+      polyglotContext.leave();
+    }
+  }
+
   String evaluateOutputText(VmTyped fileOutput) {
     return doEvaluate(() -> VmUtils.readTextProperty(fileOutput));
   }

pkl-core/src/main/java/org/pkl/core/SecurityManager.java

@@ -44,6 +44,24 @@ public interface SecurityManager {
    */
   void checkResolveResource(URI resource) throws SecurityManagerException;
 
+  /**
+   * Resolves the given {@code file:} URI to a secure, symlink-free path that has been verified to
+   * be within the root directory (if one is configured). The returned path can be opened with
+   * {@link java.nio.file.LinkOption#NOFOLLOW_LINKS}.
+   *
+   * <p>Returns {@code null} for non-{@code file:} URIs or if no root directory is configured.
+   *
+   * @param uri the URI to resolve
+   * @param isResource denotes if uri belongs to a resource (otherwise, a module)
+   * @return the resolved, symlink-free path under root directory, or {@code null}
+   * @throws SecurityManagerException if the resolved path is not within the root directory
+   * @throws IOException if the path cannot be resolved
+   */
+  default @Nullable Path resolveSecurePath(URI uri, boolean isResource)
+      throws SecurityManagerException, IOException {
+    return null;
+  }
+
   /**
    * Resolves the given {@code file:} URI to a secure, symlink-free path that has been verified to
    * be within the root directory (if one is configured). The returned path can be opened with
@@ -57,6 +75,6 @@ public interface SecurityManager {
    * @throws IOException if the path cannot be resolved
    */
   default @Nullable Path resolveSecurePath(URI uri) throws SecurityManagerException, IOException {
-    return null;
+    return resolveSecurePath(uri, false);
   }
 }

pkl-core/src/main/java/org/pkl/core/SecurityManagers.java

@@ -173,14 +173,20 @@ public final class SecurityManagers {
     }
 
     @Override
-    public @Nullable Path resolveSecurePath(URI uri) throws SecurityManagerException, IOException {
+    public @Nullable Path resolveSecurePath(URI uri, boolean isResource)
-      if (rootDir == null || !uri.isAbsolute() || !uri.getScheme().equals("file")) {
+        throws SecurityManagerException, IOException {
+      if (rootDir == null
+          || !uri.isAbsolute()
+          || !uri.getScheme().equals("file")
+          || (uri.getAuthority() != null && !uri.getAuthority().isEmpty())) {
         return null;
       }
       var path = Path.of(uri);
       var realPath = path.toRealPath();
       if (!realPath.startsWith(rootDir)) {
-        throw new SecurityManagerException(ErrorMessages.create("modulePastRootDir", uri, rootDir));
+        var errorMessageKey = isResource ? "resourcePastRootDir" : "modulePastRootDir";
+        var message = ErrorMessages.create(errorMessageKey, uri, rootDir);
+        throw new SecurityManagerException(message);
       }
       return realPath;
     }
@@ -225,6 +231,16 @@ public final class SecurityManagers {
       if (rootDir == null || !checkUri.getScheme().equals("file")) return;
 
       var path = Path.of(checkUri);
+
+      // uri represents a UNC path if authority is non-null
+      // so treat this like a potentially redirected HTTP read:
+      // check if both the given and real paths are under rootDir
+      if (checkUri.getAuthority() != null && !checkUri.getAuthority().isEmpty()) {
+        doCheckIsUnderRootDir(path.normalize(), uri, isResource);
+      }
+      // if given path is under rootDir, do I/O to determine if the real path is under the root dir
+      // this can result in a nasty timeout (~20s) in Files.exists if the server doesn't respond :(
+
       if (Files.exists(path)) {
         try {
           path = path.toRealPath();
@@ -237,6 +253,12 @@ public final class SecurityManagers {
         path = path.normalize();
       }
 
+      doCheckIsUnderRootDir(path, uri, isResource);
+    }
+
+    private void doCheckIsUnderRootDir(Path path, URI uri, boolean isResource)
+        throws SecurityManagerException {
+      assert rootDir != null;
       if (!path.startsWith(rootDir)) {
         var errorMessageKey = isResource ? "resourcePastRootDir" : "modulePastRootDir";
         var message = ErrorMessages.create(errorMessageKey, uri, rootDir);

pkl-core/src/main/java/org/pkl/core/ast/type/TypeNode.java

@@ -985,6 +985,11 @@ public abstract class TypeNode extends PklNode {
       // escape analysis should remove this allocation in compiled code
       var typeMismatches = new VmTypeMismatchException[elementTypeNodes.length];
 
+      // disallow power assertions from triggering in case one union member checks successfully
+      var localContext = VmLanguage.get(this).localContext.get();
+      var wasInTypeTest = localContext.isInTypeTest();
+      localContext.setInTypeTest(true);
+
       // Do eager checks (shallow-force) if there are two listings or two mappings represented.
       // (we can't know that `new Listing { 0; "hi" }[0]` fails for `Listing<Int>|Listing<String>`
       // without checking both index 0 and index 1).
@@ -992,15 +997,36 @@ public abstract class TypeNode extends PklNode {
       for (var i = 0; i < elementTypeNodes.length; i++) {
         var elementTypeNode = elementTypeNodes[i];
         try {
-          if (shouldEagerCheck) {
+          var result =
-            return elementTypeNode.executeEagerly(frame, value);
+              shouldEagerCheck
-          } else {
+                  ? elementTypeNode.executeEagerly(frame, value)
-            return elementTypeNode.executeLazily(frame, value);
+                  : elementTypeNode.executeLazily(frame, value);
-          }
+          localContext.setInTypeTest(wasInTypeTest);
+          return result;
         } catch (VmTypeMismatchException e) {
           typeMismatches[i] = e;
         }
       }
+
+      // all members failed to type check
+      // if enabled, re-execute type checks to generate power assertions
+      localContext.setInTypeTest(wasInTypeTest);
+      if (VmContext.get(this).getPowerAssertionsEnabled()
+          && (!wasInTypeTest || localContext.hasActiveTracker())) {
+        for (var i = 0; i < elementTypeNodes.length; i++) {
+          var elementTypeNode = elementTypeNodes[i];
+          try {
+            if (shouldEagerCheck) {
+              elementTypeNode.executeEagerly(frame, value);
+            } else {
+              elementTypeNode.executeLazily(frame, value);
+            }
+          } catch (VmTypeMismatchException e) {
+            typeMismatches[i] = e;
+          }
+        }
+      }
+
       throw new VmTypeMismatchException.Union(sourceSection, value, this, typeMismatches);
     }
 
@@ -1011,14 +1037,36 @@ public abstract class TypeNode extends PklNode {
       // escape analysis should remove this allocation in compiled code
       var typeMismatches = new VmTypeMismatchException[elementTypeNodes.length];
 
+      // disallow power assertions from triggering in case one union member checks successfully
+      var localContext = VmLanguage.get(this).localContext.get();
+      var wasInTypeTest = localContext.isInTypeTest();
+      localContext.setInTypeTest(true);
+
       for (var i = 0; i < elementTypeNodes.length; i++) {
         // eager checks
         try {
-          return elementTypeNodes[i].executeEagerly(frame, value);
+          var result = elementTypeNodes[i].executeEagerly(frame, value);
+          localContext.setInTypeTest(wasInTypeTest);
+          return result;
         } catch (VmTypeMismatchException e) {
           typeMismatches[i] = e;
         }
       }
+
+      // all members failed to type check
+      // if enabled, re-execute type checks to generate power assertions
+      localContext.setInTypeTest(wasInTypeTest);
+      if (VmContext.get(this).getPowerAssertionsEnabled()
+          && (!wasInTypeTest || localContext.hasActiveTracker())) {
+        for (var i = 0; i < elementTypeNodes.length; i++) {
+          try {
+            elementTypeNodes[i].executeEagerly(frame, value);
+          } catch (VmTypeMismatchException e) {
+            typeMismatches[i] = e;
+          }
+        }
+      }
+
       throw new VmTypeMismatchException.Union(sourceSection, value, this, typeMismatches);
     }
   }

pkl-core/src/main/java/org/pkl/core/externalreader/ExternalReaderProcessImpl.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -220,7 +220,6 @@ final class ExternalReaderProcessImpl implements ExternalReaderProcess {
                     .send(
                         request,
                         (response) -> {
-                          log(response.toString());
                           if (response instanceof InitializeResourceReaderResponse resp) {
                             var spec =
                                 resp.spec() == null

pkl-core/src/main/java/org/pkl/core/externalreader/ExternalResourceResolverImpl.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -33,6 +33,7 @@ import org.pkl.core.messaging.Messages.*;
 import org.pkl.core.messaging.ProtocolException;
 import org.pkl.core.module.PathElement;
 import org.pkl.core.resource.Resource;
+import org.pkl.core.util.Nullable;
 
 final class ExternalResourceResolverImpl implements ExternalResourceResolver {
   private final MessageTransport transport;
@@ -48,15 +49,14 @@ final class ExternalResourceResolverImpl implements ExternalResourceResolver {
 
   public Optional<Object> read(URI uri) throws IOException {
     var result = doRead(uri);
-    return Optional.of(new Resource(uri, result));
+    return result == null ? Optional.empty() : Optional.of(new Resource(uri, result));
   }
 
   public boolean hasElement(SecurityManager securityManager, URI elementUri)
       throws SecurityManagerException {
     securityManager.checkResolveResource(elementUri);
     try {
-      doRead(elementUri);
+      return doRead(elementUri) != null;
-      return true;
     } catch (IOException e) {
       return false;
     }
@@ -98,7 +98,7 @@ final class ExternalResourceResolverImpl implements ExternalResourceResolver {
             }));
   }
 
-  public byte[] doRead(URI baseUri) throws IOException {
+  public byte @Nullable [] doRead(URI baseUri) throws IOException {
     return MessageTransports.resolveFuture(
         readResponses.computeIfAbsent(
             baseUri,
@@ -113,10 +113,8 @@ final class ExternalResourceResolverImpl implements ExternalResourceResolver {
                       if (response instanceof ReadResourceResponse resp) {
                         if (resp.error() != null) {
                           future.completeExceptionally(new IOException(resp.error()));
-                        } else if (resp.contents() != null) {
-                          future.complete(resp.contents());
                         } else {
-                          future.complete(new byte[0]);
+                          future.complete(resp.contents());
                         }
                       } else {
                         future.completeExceptionally(new ProtocolException("unexpected response"));

pkl-core/src/main/java/org/pkl/core/module/ModuleKeys.java

@@ -519,6 +519,7 @@ public final class ModuleKeys {
     @Override
     public ResolvedModuleKey resolve(SecurityManager securityManager)
         throws IOException, SecurityManagerException {
+      securityManager.checkResolveModule(uri);
       var httpClient = VmContext.get(null).getHttpClient();
       var request = HttpRequest.newBuilder(uri).build();
       var response = httpClient.send(request, BodyHandlers.ofInputStream());

pkl-core/src/main/java/org/pkl/core/resource/ResourceReaders.java

@@ -262,7 +262,7 @@ public final class ResourceReaders {
       // Use resolveSecurePath to get a symlink-free path verified under rootDir.
       var securityManager = VmContext.get(null).getSecurityManager();
       try {
-        var securePath = securityManager.resolveSecurePath(uri);
+        var securePath = securityManager.resolveSecurePath(uri, true);
         if (securePath != null) {
           try (var in = Files.newInputStream(securePath, LinkOption.NOFOLLOW_LINKS)) {
             var content = in.readAllBytes();

pkl-core/src/main/java/org/pkl/core/runtime/CommandSpecParser.java

@@ -32,7 +32,6 @@ import java.util.Set;
 import java.util.function.BiFunction;
 import java.util.function.Function;
 import java.util.function.Supplier;
-import java.util.stream.Collectors;
 import org.graalvm.collections.EconomicMap;
 import org.pkl.core.CommandSpec;
 import org.pkl.core.CommandSpec.Argument;
@@ -408,7 +407,6 @@ public final class CommandSpecParser {
       } else if (typeNode instanceof TypeNode.TypeAliasTypeNode typeAliasTypeNode) {
         if (typeAliasTypeNode.getVmTypeAlias() == BaseModule.getCharTypeAlias()) break;
         typeNode = typeAliasTypeNode.getAliasedTypeNode();
-        break;
       } else {
         break;
       }
@@ -771,18 +769,18 @@ public final class CommandSpecParser {
         return true;
       } else if (typeNode
           instanceof TypeNode.UnionOfStringLiteralsTypeNode unionOfStringLiteralsTypeNode) {
-        var choices = unionOfStringLiteralsTypeNode.getStringLiterals().stream().sorted();
+        var choices = unionOfStringLiteralsTypeNode.getStringLiterals().stream().sorted().toList();
         if (each == null)
           each =
               (rawValue, workingDirUri) -> {
                 if (!unionOfStringLiteralsTypeNode.getStringLiterals().contains(rawValue)) {
-                  throw BadValue.invalidChoice(rawValue, choices.toList());
+                  throw BadValue.invalidChoice(rawValue, choices);
                 }
                 return rawValue;
               };
         if (all == null) all = this::allChooseLast;
         if (multiple == null) multiple = false;
-        if (metavar == null) metavar = "[" + choices.collect(Collectors.joining(", ")) + "]";
+        if (metavar == null) metavar = "[" + String.join(", ", choices) + "]";
         if (completionCandidates == null)
           completionCandidates = new Fixed(unionOfStringLiteralsTypeNode.getStringLiterals());
         return true;

pkl-core/src/main/java/org/pkl/core/runtime/VmLanguage.java

@@ -34,7 +34,7 @@ import org.pkl.parser.syntax.Module;
 @TruffleLanguage.Registration(
     id = "pkl",
     name = "Pkl",
-    version = "0.31.0-dev",
+    version = "0.31.1",
     characterMimeTypes = VmLanguage.MIME_TYPE,
     contextPolicy = ContextPolicy.SHARED)
 @ProvidedTags(PklTags.Expression.class)

pkl-core/src/main/java/org/pkl/core/runtime/VmLocalContext.java

@@ -28,6 +28,8 @@ public class VmLocalContext {
    */
   private int activeTrackerDepth = 0;
 
+  private boolean instrumentationEverUsed = false;
+
   public VmLocalContext() {}
 
   public void shouldEagerTypecheck(boolean shouldEagerTypecheck) {
@@ -48,6 +50,7 @@ public class VmLocalContext {
 
   public void enterTracker() {
     activeTrackerDepth++;
+    instrumentationEverUsed = true;
   }
 
   public void exitTracker() {
@@ -57,4 +60,8 @@ public class VmLocalContext {
   public boolean hasActiveTracker() {
     return activeTrackerDepth > 0;
   }
+
+  public boolean isInstrumentationEverUsed() {
+    return instrumentationEverUsed;
+  }
 }

pkl-core/src/main/java/org/pkl/core/runtime/VmTyped.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,11 +18,13 @@ package org.pkl.core.runtime;
 import com.oracle.truffle.api.CompilerDirectives.CompilationFinal;
 import com.oracle.truffle.api.CompilerDirectives.TruffleBoundary;
 import com.oracle.truffle.api.frame.MaterializedFrame;
+import com.oracle.truffle.api.instrumentation.InstrumentableNode.WrapperNode;
 import org.graalvm.collections.EconomicMap;
 import org.graalvm.collections.UnmodifiableEconomicMap;
 import org.pkl.core.Composite;
 import org.pkl.core.PModule;
 import org.pkl.core.PObject;
+import org.pkl.core.ast.ExpressionNode;
 import org.pkl.core.ast.expression.unary.ImportNode;
 import org.pkl.core.ast.member.ObjectMember;
 import org.pkl.core.util.EconomicMaps;
@@ -103,9 +105,11 @@ public final class VmTyped extends VmObject {
       if (member.isImport()) {
         var memberNode = member.getMemberNode();
         assert memberNode != null; // import is never a constant
-        builder.add(
+        var bodyNode = memberNode.getBodyNode();
-            member.getName().toString(),
+        if (bodyNode instanceof WrapperNode wrapper) {
-            ((ImportNode) memberNode.getBodyNode()).getImportUri().toString());
+          bodyNode = (ExpressionNode) wrapper.getDelegateNode();
+        }
+        builder.add(member.getName().toString(), ((ImportNode) bodyNode).getImportUri().toString());
       }
     }
     return builder.build();

pkl-core/src/test/files/LanguageSnippetTests/input/api/reflect5.pkl

@@ -0,0 +1,15 @@
+import "pkl:reflect"
+import "pkl:test"
+
+class Foo {
+  bar: String(startsWith("a"))
+}
+
+// regression test for VmTyped.getImports()
+// which walks module members that are imports and casts their bodies to ImportNode
+// the catch activates instrumentation by failing a constraint check
+// so that the reflected import member bodies are wrapper nodes instead of ImportNode directly
+// the fix for this unwraps the wrapper before casting to ImportNode
+foo =
+  let (_ = test.catchOrNull(() -> new Foo { bar = "baz" }.bar))
+    reflect.Module(module).imports

pkl-core/src/test/files/LanguageSnippetTests/output/api/reflect5.pcf

@@ -0,0 +1 @@
+foo = Map("reflect", "pkl:reflect", "test", "pkl:test")

pkl-core/src/test/kotlin/org/pkl/core/EvaluatorTest.kt

@@ -22,6 +22,7 @@ import java.nio.file.FileSystems
 import java.nio.file.Files
 import java.nio.file.Path
 import java.util.*
+import java.util.concurrent.TimeUnit
 import java.util.regex.Pattern
 import kotlin.io.path.createParentDirectories
 import kotlin.io.path.writeText
@@ -29,7 +30,10 @@ import org.assertj.core.api.Assertions.assertThat
 import org.assertj.core.api.Assertions.assertThatCode
 import org.junit.jupiter.api.AfterAll
 import org.junit.jupiter.api.Test
+import org.junit.jupiter.api.Timeout
 import org.junit.jupiter.api.assertThrows
+import org.junit.jupiter.api.condition.EnabledOnOs
+import org.junit.jupiter.api.condition.OS
 import org.junit.jupiter.api.io.TempDir
 import org.pkl.commons.createTempFile
 import org.pkl.commons.test.PackageServer
@@ -540,6 +544,91 @@ class EvaluatorTest {
     }
   }
 
+  @Test
+  @EnabledOnOs(OS.WINDOWS)
+  @Timeout(1, unit = TimeUnit.SECONDS)
+  fun `root dir check happens without any UNC or SMB access`() {
+    val evaluator =
+      with(EvaluatorBuilder.preconfigured()) {
+        rootDir = Path.of("/tmp/test")
+        build()
+      }
+    // this uses a TEST-NET-1 IP which has no server running in order to force a timeout-driven
+    // failure (takes ~20s)
+    // root dir check failure should prevent any I/O and fail fast instead of hitting the timeout
+    val exc =
+      assertThrows<PklException> {
+        evaluator.evaluate(text("result = import(\"file://192.0.2.1/share/nope.pkl\")"))
+      }
+    assertThat(exc)
+      .hasMessageContaining(
+        "Refusing to load module `file://192.0.2.1/share/nope.pkl` because it is not within the root directory (`--root-dir`)."
+      )
+  }
+
+  @Test
+  fun `constraint failures activate instrumentation`() {
+    val evaluator =
+      with(EvaluatorBuilder.preconfigured()) {
+        powerAssertionsEnabled = true
+        build()
+      }
+
+    val exc =
+      assertThrows<PklException> {
+        evaluator.evaluate(
+          text(
+            """
+    foo: String(chars.first == "a") = "boo"
+    """
+              .trimIndent()
+          )
+        )
+      }
+
+    assertThat((evaluator as EvaluatorImpl).isInstrumentationEverUsed()).isTrue
+  }
+
+  @Test
+  fun `union single-member constraint failures do not activate instrumentation`() {
+    val evaluator =
+      with(EvaluatorBuilder.preconfigured()) {
+        powerAssertionsEnabled = true
+        build()
+      }
+
+    evaluator.evaluate(
+      text(
+        """
+    foo: String(startsWith("a")) | String(startsWith("b")) | String(startsWith("c")) = "cool"
+    """
+          .trimIndent()
+      )
+    )
+
+    assertThat((evaluator as EvaluatorImpl).isInstrumentationEverUsed()).isFalse
+  }
+
+  @Test
+  fun `type test failures do not activate instrumentation`() {
+    val evaluator =
+      with(EvaluatorBuilder.preconfigured()) {
+        powerAssertionsEnabled = true
+        build()
+      }
+
+    evaluator.evaluate(
+      text(
+        """
+    foo = "bar" is Int(this > 0)
+    """
+          .trimIndent()
+      )
+    )
+
+    assertThat((evaluator as EvaluatorImpl).isInstrumentationEverUsed()).isFalse
+  }
+
   private fun checkModule(module: PModule) {
     assertThat(module.properties.size).isEqualTo(2)
     assertThat(module.getProperty("name")).isEqualTo("pigeon")

pkl-core/src/test/kotlin/org/pkl/core/module/ModuleKeysTest.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,6 +20,7 @@ import java.net.MalformedURLException
 import java.net.URI
 import java.net.URISyntaxException
 import java.nio.file.Path
+import java.util.regex.Pattern
 import kotlin.io.path.createFile
 import kotlin.io.path.createParentDirectories
 import org.assertj.core.api.Assertions.assertThat
@@ -28,6 +29,7 @@ import org.junit.jupiter.api.assertThrows
 import org.junit.jupiter.api.io.TempDir
 import org.pkl.commons.toPath
 import org.pkl.commons.writeString
+import org.pkl.core.SecurityManagerException
 import org.pkl.core.SecurityManagers
 
 class ModuleKeysTest {
@@ -207,6 +209,27 @@ class ModuleKeysTest {
     assertThat(e).hasMessageContaining("Package URIs must have a path component")
   }
 
+  @Test
+  fun `http - resolve obeys allowed modules`() {
+    val uri = URI("https://apple.com/some/foo.pkl")
+    val key = ModuleKeys.genericUrl(uri)
+
+    assertThat(key.uri).isEqualTo(uri)
+    assertThat(key.isCached).isTrue
+
+    assertThat(ModuleKeys.isStdLibModule(key)).isFalse
+    assertThat(ModuleKeys.isBaseModule(key)).isFalse
+
+    assertThrows<SecurityManagerException> {
+      key.resolve(
+        with(SecurityManagers.standardBuilder()) {
+          setAllowedModules(listOf(Pattern.compile("repl:"), Pattern.compile("file:")))
+          build()
+        }
+      )
+    }
+  }
+
   @Test
   fun `generic URL`() {
     val uri = URI("https://apple.com/some/foo.pkl")

pkl-core/src/test/kotlin/org/pkl/core/runtime/CommandSpecParserTest.kt

@@ -787,4 +787,55 @@ class CommandSpecParserTest {
       .contains("Option `foo` with annotation `@CountedFlag` has invalid type `String`.")
     assertThat(exc.message).contains("Expected type: `Int`")
   }
+
+  @Test
+  fun `union typed option validates invalid choice without stream error`() {
+    val moduleUri =
+      writePklFile(
+        "cmd.pkl",
+        renderOptions +
+          """
+      class Options {
+        format: "json" | "yaml" | "toml"
+      }
+    """
+            .trimIndent(),
+      )
+
+    val spec = parse(moduleUri)
+    val flag = spec.options.first() as CommandSpec.Flag
+
+    assertThat(flag.metavar()).isEqualTo("[json, toml, yaml]")
+
+    val apply =
+      assertThrows<CommandSpec.Option.BadValue> {
+        flag.transformEach().apply("xml", URI("file:///tmp"))
+      }
+    assertThat(apply.message).contains("invalid choice")
+    assertThat(apply.message).contains("xml")
+  }
+
+  @Test
+  fun `typealias of nullable is resolved as optional`() {
+    val moduleUri =
+      writePklFile(
+        "cmd.pkl",
+        renderOptions +
+          """
+      typealias OptionalString = String?
+      class Options {
+        foo: OptionalString
+      }
+    """
+            .trimIndent(),
+      )
+
+    val spec = parse(moduleUri)
+
+    assertThat(spec.options.toList()[0]).isInstanceOf(CommandSpec.Flag::class.java)
+    (spec.options.toList()[0] as CommandSpec.Flag).apply {
+      assertThat(this.name).isEqualTo("foo")
+      assertThat(this.showAsRequired).isFalse()
+    }
+  }
 }

stdlib/Benchmark.pkl

@@ -36,7 +36,7 @@
 ///
 /// Warning: Although this module is ready for initial use,
 /// benchmark results may be inaccurate or inconsistent.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.Benchmark
 
 import "pkl:platform" as _platform

stdlib/Command.pkl

@@ -29,7 +29,7 @@
 ///   // ...
 /// }
 /// ```
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 open module pkl.Command
 
 import "pkl:Command"

stdlib/DocPackageInfo.pkl

@@ -63,7 +63,7 @@
 /// @Deprecated { message = "Use `com.example.Birds.Parrot` instead" }
 /// amends "pkl:PackageInfo"
 /// ```
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.DocPackageInfo
 
 // used by doc comments

stdlib/DocsiteInfo.pkl

@@ -31,7 +31,7 @@
 ///
 /// title = "Title displayed in the header of each page"
 /// ```
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.DocsiteInfo
 
 import "pkl:reflect"

stdlib/EvaluatorSettings.pkl

@@ -15,7 +15,7 @@
 //===----------------------------------------------------------------------===//
 
 /// Common settings for Pkl's own evaluator.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 @Since { version = "0.26.0" }
 module pkl.EvaluatorSettings
 

stdlib/Project.pkl

@@ -64,7 +64,7 @@
 ///   value = project
 /// }
 /// ``` 
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.Project
 
 import "pkl:EvaluatorSettings" as EvaluatorSettingsModule

stdlib/analyze.pkl

@@ -19,7 +19,7 @@
 /// These tools differentiate from [pkl:reflect][reflect] in that they parse Pkl modules, but do not
 /// execute any code within these modules.
 @Since { version = "0.27.0" }
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.analyze
 
 // used by doc comments

stdlib/base.pkl

@@ -17,7 +17,7 @@
 /// Fundamental properties, methods, and classes for writing Pkl programs.
 ///
 /// Members of this module are automatically available in every Pkl module.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.base
 
 // json, math, and yaml imports used for doc comments

stdlib/json.pkl

@@ -15,7 +15,7 @@
 //===----------------------------------------------------------------------===//
 
 /// A JSON parser.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.json
 
 /// Annotate properties of classes and modules with this class to override how a [JsonRenderer]

stdlib/jsonnet.pkl

@@ -15,7 +15,7 @@
 //===----------------------------------------------------------------------===//
 
 /// A [Jsonnet](https://jsonnet.org) renderer.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.jsonnet
 
 /// Constructs an [ImportStr].

stdlib/math.pkl

@@ -18,7 +18,7 @@
 ///
 /// Note that some mathematical functions, such as `sign()`, `abs()`, and `round()`,
 /// are directly defined in classes [Number], [Int], and [Float].
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.math
 
 /// The minimum [Int] value: `-9223372036854775808`.

stdlib/pklbinary.pkl

@@ -28,7 +28,7 @@
 /// The `pkl-binary` format uses MessagePack encoding.
 /// Its specification is available at
 /// <https://pkl-lang.org/main/current/bindings-specification/binary-encoding.html>.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.pklbinary
 
 /// Render values as `pkl-binary`.

stdlib/platform.pkl

@@ -15,7 +15,7 @@
 //===----------------------------------------------------------------------===//
 
 /// Information about the platform that the current program runs on.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.platform
 
 /// The platform that the current program runs on.

stdlib/protobuf.pkl

@@ -16,7 +16,7 @@
 
 /// A renderer for [Protocol Buffers](https://developers.google.com/protocol-buffers).
 /// Note: This module is _experimental_ and not ready for production use.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.protobuf
 
 import "pkl:reflect"

stdlib/reflect.pkl

@@ -26,7 +26,7 @@
 /// - Documentation generators (such as *Pkldoc*)
 /// - Code generators (such as *pkl-codegen-java* and *pkl-codegen-kotlin*)
 /// - Domain-specific schema validators
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.reflect
 
 import "pkl:base"

stdlib/release.pkl

@@ -15,7 +15,7 @@
 //===----------------------------------------------------------------------===//
 
 /// Information about the Pkl release that the current program runs on.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.release
 
 import "pkl:semver"

stdlib/semver.pkl

@@ -15,7 +15,7 @@
 //===----------------------------------------------------------------------===//
 
 /// Parsing, comparison, and manipulation of [semantic version](https://semver.org/spec/v2.0.0.html) numbers.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.semver
 
 /// Tells whether [version] is a valid semantic version number.

stdlib/settings.pkl

@@ -19,7 +19,7 @@
 /// Every settings file must amend this module.
 /// Unless CLI commands and build tool plugins are explicitly configured with a settings file,
 /// they will use `~/.pkl/settings.pkl` or the defaults specified in this module.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.settings
 
 import "pkl:EvaluatorSettings"

stdlib/shell.pkl

@@ -15,7 +15,7 @@
 //===----------------------------------------------------------------------===//
 
 /// Utilities for generating shell scripts.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.shell
 
 /// Escapes [str] by enclosing it in single quotes.

stdlib/test.pkl

@@ -18,7 +18,7 @@
 ///
 /// To write tests, amend this module and define [facts] or [examples] (or both).
 /// To run tests, use the `pkl test` command to evaluate the amended module.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 open module pkl.test
 
 /// Named groups of boolean expressions that are expected to evaluate to [true].

stdlib/xml.pkl

@@ -15,7 +15,7 @@
 //===----------------------------------------------------------------------===//
 
 /// An XML renderer.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.xml
 
 /// Renders values as XML.

stdlib/yaml.pkl

@@ -15,7 +15,7 @@
 //===----------------------------------------------------------------------===//
 
 /// A YAML 1.2 compliant YAML parser.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.yaml
 
 /// Annotate properties of classes and modules with this class to override how a [YamlRenderer]