Prepare 0.31.1 release

Add 0.31.1 changelog (#1473 )
Closes #1472 Co-authored-by: Islon Scherer <i_desouzascherer@apple.com>
2026-05-25 16:19:20 +02:00 · 2026-03-26 09:08:16 -07:00 · 2026-03-26 09:02:12 -07:00 · 2026-03-26 09:01:52 -07:00 · 2026-03-25 12:13:21 -07:00 · 2026-03-25 12:13:13 -07:00
62 changed files with 740 additions and 239 deletions
@@ -2,7 +2,7 @@ amends "pkl:Project"

 dependencies {
  ["pkl.impl.ghactions"] {
-    uri = "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.3.5"
+    uri = "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.5.0"
  }
  ["gha"] {
    uri = "package://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1.2.0"
@@ -10,9 +10,9 @@
    },
    "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1": {
      "type": "remote",
-      "uri": "projectpackage://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.3.5",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.5.0",
      "checksums": {
-        "sha256": "2b26d02c3b244a28e7913457ba195cbf767a1d1079ab2ed469074c4da870de12"
+        "sha256": "2c1e0d9efcd65b3c3207bf535c325ebc0ec2ab169187b324c4bb70821cac0e51"
      }
    },
    "package://pkg.pkl-lang.org/pkl-pantry/pkl.experimental.deepToTyped@1": {
@@ -12,7 +12,7 @@ project: String
 extraGradleArgs {
  when (os == "macOS" && arch == "amd64") {
    "-Dpkl.targetArch=\(module.arch)"
-    "-Dpkl.native--native-compiler-path=\(context.github.workspace)/.github/scripts/cc_macos_amd64.sh"
+    #""-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh""#
  }
  when (musl) {
    "-Dpkl.musl=true"
@@ -40,7 +40,7 @@ steps {
    new {
      name = "Fix git ownership"
      // language=bash
-      run = "git status || git config --system --add safe.directory $GITHUB_WORKSPACE"
+      run = #"git status || git config --system --add safe.directory "$GITHUB_WORKSPACE""#
    }
  }
  new {
@@ -90,7 +90,13 @@ fixed job {
            "aarch64"
      }
    }
-    catalog.`gradle/actions/setup-gradle@v5`
+    (catalog.`gradle/actions/setup-gradle@v5`) {
+      when (isRelease) {
+        with {
+          `cache-disabled` = true
+        }
+      }
+    }
    ...module.steps
  }
 }
@@ -21,7 +21,7 @@ jobs:
    - name: actions/checkout@v6
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
    - name: actions/create-github-app-token@v2
-      uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
+      uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
    - name: actions/download-artifact@v6
      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
    - name: actions/setup-java@v5
@@ -31,4 +31,4 @@ jobs:
    - name: dawidd6/action-download-artifact@v11
      uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # v11
    - name: gradle/actions/setup-gradle@v5
-      uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+      uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
@@ -28,7 +28,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: check
      shell: bash
@@ -61,7 +61,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: check
      shell: bash
@@ -92,7 +92,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: bench:jmh
      shell: bash
@@ -111,7 +111,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
      shell: bash
@@ -143,7 +143,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      with:
@@ -185,11 +185,11 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: gradle buildNative
      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-cli:buildNative
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
    - name: Upload executable artifacts
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
      with:
@@ -223,10 +223,10 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
    - name: gradle buildNative
      shell: bash
      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -266,7 +266,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: gradle buildNative
      shell: bash
@@ -304,10 +304,10 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
    - name: gradle buildNative
      shell: bash
      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -344,7 +344,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: Install musl and zlib
      run: |
@@ -454,7 +454,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: gradle buildNative
      shell: bash
@@ -493,11 +493,11 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: gradle buildNative
      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-doc:buildNative
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
    - name: Upload executable artifacts
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
      with:
@@ -531,10 +531,10 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
    - name: gradle buildNative
      shell: bash
      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -574,7 +574,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: gradle buildNative
      shell: bash
@@ -612,10 +612,10 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
    - name: gradle buildNative
      shell: bash
      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -652,7 +652,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: Install musl and zlib
      run: |
@@ -762,7 +762,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: gradle buildNative
      shell: bash
@@ -26,7 +26,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: check
      shell: bash
@@ -59,7 +59,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: check
      shell: bash
@@ -90,7 +90,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: bench:jmh
      shell: bash
@@ -109,7 +109,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
      shell: bash
@@ -141,7 +141,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      with:
@@ -183,11 +183,11 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: gradle buildNative
      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-cli:buildNative
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
    - name: Upload executable artifacts
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
      with:
@@ -221,10 +221,10 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
    - name: gradle buildNative
      shell: bash
      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -264,7 +264,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: gradle buildNative
      shell: bash
@@ -302,10 +302,10 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
    - name: gradle buildNative
      shell: bash
      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -342,7 +342,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: Install musl and zlib
      run: |
@@ -452,7 +452,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: gradle buildNative
      shell: bash
@@ -491,11 +491,11 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: gradle buildNative
      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-doc:buildNative
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
    - name: Upload executable artifacts
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
      with:
@@ -529,10 +529,10 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
    - name: gradle buildNative
      shell: bash
      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -572,7 +572,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: gradle buildNative
      shell: bash
@@ -610,10 +610,10 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
    - name: gradle buildNative
      shell: bash
      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -650,7 +650,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: Install musl and zlib
      run: |
@@ -760,7 +760,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: gradle buildNative
      shell: bash
@@ -815,7 +815,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      with:
@@ -896,7 +896,7 @@ jobs:
    steps:
    - name: Create app token
      id: app-token
-      uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
+      uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
      with:
        app-id: ${{ secrets.PKL_CI_CLIENT_ID }}
        private-key: ${{ secrets.PKL_CI }}
@@ -904,9 +904,10 @@ jobs:
    - name: Trigger pkl-lang.org build
      env:
        GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        SOURCE_RUN: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
      run: |-
        gh workflow run \
          --repo apple/pkl-lang.org \
          --ref main \
-          --field source_run="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+          --field source_run="${SOURCE_RUN}" \
          main.yml
@@ -22,7 +22,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: check
      shell: bash
@@ -57,7 +57,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: check
      shell: bash
@@ -92,11 +92,11 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: gradle buildNative
      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-cli:buildNative
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
    - name: Upload executable artifacts
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
      with:
@@ -132,10 +132,10 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
    - name: gradle buildNative
      shell: bash
      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -176,7 +176,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: gradle buildNative
      shell: bash
@@ -216,10 +216,10 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
    - name: gradle buildNative
      shell: bash
      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -258,7 +258,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: Install musl and zlib
      run: |
@@ -370,7 +370,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: gradle buildNative
      shell: bash
@@ -410,11 +410,11 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: gradle buildNative
      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-doc:buildNative
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
    - name: Upload executable artifacts
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
      with:
@@ -450,10 +450,10 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
    - name: gradle buildNative
      shell: bash
      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -494,7 +494,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: gradle buildNative
      shell: bash
@@ -534,10 +534,10 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
    - name: gradle buildNative
      shell: bash
      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -576,7 +576,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: Install musl and zlib
      run: |
@@ -688,7 +688,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: gradle buildNative
      shell: bash
@@ -26,7 +26,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: check
      shell: bash
@@ -59,7 +59,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: check
      shell: bash
@@ -90,7 +90,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: bench:jmh
      shell: bash
@@ -109,7 +109,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
      shell: bash
@@ -141,7 +141,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      with:
@@ -183,11 +183,11 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: gradle buildNative
      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-cli:buildNative
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
    - name: Upload executable artifacts
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
      with:
@@ -221,10 +221,10 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
    - name: gradle buildNative
      shell: bash
      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -264,7 +264,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: gradle buildNative
      shell: bash
@@ -302,10 +302,10 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
    - name: gradle buildNative
      shell: bash
      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -342,7 +342,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: Install musl and zlib
      run: |
@@ -452,7 +452,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: gradle buildNative
      shell: bash
@@ -491,11 +491,11 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: gradle buildNative
      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-doc:buildNative
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
    - name: Upload executable artifacts
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
      with:
@@ -529,10 +529,10 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
    - name: gradle buildNative
      shell: bash
      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -572,7 +572,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: gradle buildNative
      shell: bash
@@ -610,10 +610,10 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
    - name: gradle buildNative
      shell: bash
      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -650,7 +650,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: Install musl and zlib
      run: |
@@ -760,7 +760,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: gradle buildNative
      shell: bash
@@ -847,7 +847,7 @@ jobs:
    steps:
    - name: Create app token
      id: app-token
-      uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
+      uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
      with:
        app-id: ${{ secrets.PKL_CI_CLIENT_ID }}
        private-key: ${{ secrets.PKL_CI }}
@@ -855,9 +855,10 @@ jobs:
    - name: Trigger pkl-lang.org build
      env:
        GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        SOURCE_RUN: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
      run: |-
        gh workflow run \
          --repo apple/pkl-lang.org \
          --ref main \
-          --field source_run="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+          --field source_run="${SOURCE_RUN}" \
          main.yml
@@ -26,7 +26,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: check
      shell: bash
@@ -59,7 +59,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: check
      shell: bash
@@ -90,7 +90,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: bench:jmh
      shell: bash
@@ -109,7 +109,7 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
      with: {}
    - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
      shell: bash
@@ -141,8 +141,9 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
-      with: {}
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      with:
        persist-credentials: false
@@ -183,11 +184,12 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
-      with: {}
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
    - name: gradle buildNative
      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-cli:buildNative
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
    - name: Upload executable artifacts
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
      with:
@@ -221,10 +223,11 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
-      with: {}
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
    - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
    - name: gradle buildNative
      shell: bash
      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
@@ -264,8 +267,9 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
-      with: {}
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
    - name: gradle buildNative
      shell: bash
      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
@@ -302,10 +306,11 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
-      with: {}
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
    - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
    - name: gradle buildNative
      shell: bash
      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
@@ -342,8 +347,9 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
-      with: {}
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
    - name: Install musl and zlib
      run: |
        set -e
@@ -452,8 +458,9 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
-      with: {}
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
    - name: gradle buildNative
      shell: bash
      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
@@ -491,11 +498,12 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
-      with: {}
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
    - name: gradle buildNative
      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-doc:buildNative
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
    - name: Upload executable artifacts
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
      with:
@@ -529,10 +537,11 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
-      with: {}
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
    - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
    - name: gradle buildNative
      shell: bash
      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
@@ -572,8 +581,9 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
-      with: {}
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
    - name: gradle buildNative
      shell: bash
      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
@@ -610,10 +620,11 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
-      with: {}
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
    - name: Fix git ownership
-      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
    - name: gradle buildNative
      shell: bash
      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
@@ -650,8 +661,9 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
-      with: {}
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
    - name: Install musl and zlib
      run: |
        set -e
@@ -760,8 +772,9 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
-      with: {}
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
    - name: gradle buildNative
      shell: bash
      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
@@ -815,8 +828,9 @@ jobs:
        java-version: '21'
        distribution: temurin
        architecture: x64
-    - uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5
-      with: {}
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      with:
        persist-credentials: false
@@ -923,7 +937,7 @@ jobs:
    steps:
    - name: Create app token
      id: app-token
-      uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
+      uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
      with:
        app-id: ${{ secrets.PKL_CI_CLIENT_ID }}
        private-key: ${{ secrets.PKL_CI }}
@@ -931,9 +945,10 @@ jobs:
    - name: Trigger pkl-lang.org build
      env:
        GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        SOURCE_RUN: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
      run: |-
        gh workflow run \
          --repo apple/pkl-lang.org \
          --ref main \
-          --field source_run="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+          --field source_run="${SOURCE_RUN}" \
          main.yml
@@ -12,6 +12,27 @@
      <option name="REPORT_FIELDS" value="true" />
    </inspection_tool>
    <inspection_tool class="ClassCanBeRecord" enabled="false" level="WEAK WARNING" enabled_by_default="false" />
+    <inspection_tool class="CustomRegExpInspection" enabled="true" level="WARNING" enabled_by_default="true">
+      <option name="myConfigurations">
+        <list>
+          <RegExpInspectionConfiguration>
+            <option name="name" value="PklCliDirectProjectEvaluatorSettingsAccess" />
+            <option name="suppressId" value="PklCliDirectProjectEvaluatorSettingsAccess" />
+            <option name="uuid" value="dd497f47-d38f-3fab-9ed7-eabe699620c8" />
+            <option name="patterns">
+              <list>
+                <InspectionPattern>
+                  <option name="regExp" value="project\?\.evaluatorSettings" />
+                  <option name="_fileType" value="Kotlin" />
+                  <option name="searchContext" value="ANY" />
+                  <option name="replacement" value="evaluatorSettings" />
+                </InspectionPattern>
+              </list>
+            </option>
+          </RegExpInspectionConfiguration>
+        </list>
+      </option>
+    </inspection_tool>
    <inspection_tool class="FieldMayBeFinal" enabled="true" level="INFORMATION" enabled_by_default="true">
      <scope name="AllExceptTruffleAst" level="WARNING" enabled="true" />
    </inspection_tool>
@@ -73,5 +94,6 @@
      <option name="processLiterals" value="true" />
      <option name="processComments" value="true" />
    </inspection_tool>
+    <inspection_tool class="dd497f47-d38f-3fab-9ed7-eabe699620c8" enabled="true" level="ERROR" enabled_by_default="true" editorAttributes="ERRORS_ATTRIBUTES" />
  </profile>
 </component>
@@ -1,6 +1,6 @@
 name: main
 title: Main Project
-version: 0.31.0-dev
-prerelease: true
+version: 0.31.1
+prerelease: false
 nav:
 - nav.adoc
@@ -3,10 +3,10 @@
 // the following attributes must be updated immediately before a release

 // pkl version corresponding to current git commit without -dev suffix or git hash
-:pkl-version-no-suffix: 0.31.0
+:pkl-version-no-suffix: 0.31.1
 // tells whether pkl version corresponding to current git commit
 // is a release version (:is-release-version: '') or dev version (:!is-release-version:)
-:!is-release-version:
+:is-release-version: ''

 // the remaining attributes do not need to be updated regularly

@@ -4922,7 +4922,7 @@ animals {
 ==== Receiver

 The receiver is the bottom-most object in the <<prototype-chain>>.
-That means that, within the context of an amending object, the reciever is the amending object.
+That means that, within the context of an amending object, the receiver is the amending object.

 Example:
 [source,pkl]
@@ -266,7 +266,7 @@ Thanks to https://github.com/gordonbondon[@gordonbondon] for contributing to thi

 === `@Generated` annotation for Java/Kotlin codegen

-Classes generated by the Java and Kotlin code generator can optionally recieve new annotation called `Generated` (https://github.com/apple/pkl/pull/1075[#1075], https://github.com/apple/pkl/pull/1115[#1115]).
+Classes generated by the Java and Kotlin code generator can optionally receive new annotation called `Generated` (https://github.com/apple/pkl/pull/1075[#1075], https://github.com/apple/pkl/pull/1115[#1115]).

 This behavior is toggled with the `--generated-annotation` CLI flag, or the similarly named Gradle property.

@@ -1,6 +1,6 @@
 = Pkl 0.31 Release Notes
 :version: 0.31
-:version-minor: 0.31.0
+:version-minor: 0.31.1
 :release-date: February 26th, 2026
 :version-next: 0.32
 :version-next-date: July 2026
@@ -55,7 +55,7 @@ Value: new Person { name = "Bub Johnson" }
 7 | passenger: Person(name.endsWith(lastName)) = new { name = "Bub Johnson" }
 ----

-Now, we know what the expecation actually is.
+Now, we know what the expectation is.

 This type of diagram is also added to test facts.
 When tests fail, Pkl emits a diagram of the expression, and the values produced.
@@ -1,10 +1,41 @@
 = Changelog
 include::ROOT:partial$component-attributes.adoc[]

+[[release-0.31.1]]
+== 0.31.1 (2026-03-26)
+
+=== Breaking Changes [small]#💔#
+
+* Allow nullable reads for custom/external resources (pr:https://github.com/apple/pkl/pull/1471[]).
+
+This allows custom/external resources to produce `null` values for xref:language-reference:index.adoc#nullable-reads[nullable reads] (`read?`).
+While this is a breaking change in behavior, it is currently not possible to exercise with versions of pkl-go or pkl-swift released prior to this change.
+
+=== Fixes
+
+* Fix typo in changelog and language reference (pr:https://github.com/apple/pkl/pull/1455[]).
+* Fix bugs in `CommandSpecParser` (pr:https://github.com/apple/pkl/pull/1448[], pr:https://github.com/apple/pkl/pull/1449[]).
+* Respect `--omit-project-settings` for all evaluator options (pr:https://github.com/apple/pkl/pull/1459[]).
+* Fix SecurityManager check for HTTP(S) module URIs (pr:https://github.com/apple/pkl/pull/1463[]).
+* Fix performance regression caused by activation of power assertion instrumentation during some union type checks (pr:https://github.com/apple/pkl/pull/1462[]).
+* Fix module reflection when power assertion instrumentation is active (pr:https://github.com/apple/pkl/pull/1464[]).
+* Prevent I/O when checking UNC paths against `--root-dir` (pr:https://github.com/apple/pkl/pull/1466[]).
+* Prevent `--multiple-file-output-path` writes from following symlinks outside the target directory
+(pr:https://github.com/apple/pkl/pull/1467[]).
+
+=== Contributors ❤️
+
+Thank you to all the contributors for this release!
+
+* https://github.com/04cb[@04cb]
+* https://github.com/HT154[@HT154]
+* https://github.com/KushalP[@KushalP]
+
 [[release-0.31.0]]
-== 0.31.0 (UNRELEASED)
+== 0.31.0 (2026-02-26)

 xref:0.31.adoc[Release Notes]
+
 [[release-0.30.2]]

 == 0.30.2 (2025-12-15)
@@ -1,7 +1,7 @@
 # suppress inspection "UnusedProperty" for whole file

 group=org.pkl-lang
-version=0.31.0
+version=0.31.1

 # google-java-format requires jdk.compiler exports
 org.gradle.jvmargs= \
@@ -2,15 +2,15 @@
  "catalogs": {},
  "aliases": {
    "pkl": {
-      "script-ref": "org.pkl-lang:pkl-cli-java:0.30.2",
+      "script-ref": "org.pkl-lang:pkl-cli-java:0.31.1",
      "java-agents": []
    },
    "pkl-codegen-java": {
-      "script-ref": "org.pkl-lang:pkl-codegen-java:0.30.2",
+      "script-ref": "org.pkl-lang:pkl-codegen-java:0.31.1",
      "java-agents": []
    },
    "pkl-codegen-kotlin": {
-      "script-ref": "org.pkl-lang:pkl-codegen-kotlin:0.30.2",
+      "script-ref": "org.pkl-lang:pkl-codegen-kotlin:0.31.1",
      "java-agents": []
    }
  },
@@ -240,8 +240,7 @@ constructor(

      for ((pathSpec, fileOutput) in output) {
        checkPathSpec(pathSpec)
-        val resolvedPath = realOutputDir.resolve(pathSpec).normalize()
-        val realPath = if (resolvedPath.exists()) resolvedPath.toRealPath() else resolvedPath
+        val (realPath, resolvedPath) = realOutputDir.resolveRealPath(Path.of(pathSpec))
        if (!realPath.startsWith(realOutputDir)) {
          throw CliException(
            "Output file conflict: `output.files` entry `\"$pathSpec\"` in module `$moduleUri` resolves to file path `$realPath`, which is outside output directory `$realOutputDir`."
@@ -269,4 +268,22 @@ constructor(
      }
    }
  }
+
+  /**
+   * Resolves [rel] against this Path name-by-name. At each step, the real path is resolved if the
+   * file exists. The normalized real path and normalized resolved path are returned. This has a
+   * similar effect to `this.resolve(rel).toRealPath().normalize()`, but the real paths account for
+   * symlinks in the middle of the relative path so the full path need not exist.
+   */
+  private fun Path.resolveRealPath(rel: Path): Pair<Path, Path> {
+    assert(!rel.isAbsolute)
+    var resolved = this
+    var real = this
+    for (name in rel) {
+      resolved = resolved.resolve(name)
+      real = real.resolve(name)
+      if (real.exists()) real = real.toRealPath()
+    }
+    return real.normalize() to resolved.normalize()
+  }
 }
@@ -931,6 +931,37 @@ result = someLib.x
      .hasMessageContaining("which is outside output directory")
  }

+  @Test
+  @DisabledOnOs(OS.WINDOWS)
+  fun `multiple file output throws if files are written outside the base path via symlink`() {
+    val output = tempDir.resolve(".output").createDirectories()
+    val outside = tempDir.resolve("outside").createDirectories()
+    output.resolve("outside").createSymbolicLinkPointingTo(outside)
+
+    val moduleUri =
+      writePklFile(
+        "test.pkl",
+        """
+        output {
+          files {
+            ["outside/foo.txt"] {
+              text = "bar"
+            }
+          }
+        }
+      """
+          .trimIndent(),
+      )
+    val options =
+      CliEvaluatorOptions(
+        CliBaseOptions(sourceModules = listOf(moduleUri), workingDir = tempDir),
+        multipleFileOutputPath = ".output",
+      )
+    assertThatCode { evalToConsole(options) }
+      .hasMessageStartingWith("Output file conflict:")
+      .hasMessageContaining("which is outside output directory")
+  }
+
  @Test
  fun `multiple file output throws if file path is a directory`() {
    tempDir.resolve(".output/myDir").createDirectories()
@@ -139,6 +139,7 @@ abstract class CliCommand(protected val cliOptions: CliBaseOptions) {
  }

  private val evaluatorSettings: PklEvaluatorSettings? by lazy {
+    @Suppress("PklCliDirectProjectEvaluatorSettingsAccess")
    if (cliOptions.omitProjectSettings) null else project?.evaluatorSettings
  }

@@ -199,34 +200,30 @@ abstract class CliCommand(protected val cliOptions: CliBaseOptions) {
    )
  }

-  protected val useColor: Boolean by lazy { cliOptions.color?.hasColor() ?: false }
-
-  private val proxyAddress: URI? by lazy {
-    cliOptions.httpProxy
-      ?: project?.evaluatorSettings?.http?.proxy?.address
-      ?: settings.http?.proxy?.address
+  protected val useColor: Boolean by lazy {
+    cliOptions.color?.hasColor() ?: evaluatorSettings?.color?.hasColor() ?: false
  }

-  private val noProxy: List<String>? by lazy {
+  protected val proxyAddress: URI? by lazy {
+    cliOptions.httpProxy ?: evaluatorSettings?.http?.proxy?.address ?: settings.http?.proxy?.address
+  }
+
+  protected val noProxy: List<String>? by lazy {
    cliOptions.httpNoProxy
-      ?: project?.evaluatorSettings?.http?.proxy?.noProxy
+      ?: evaluatorSettings?.http?.proxy?.noProxy
      ?: settings.http?.proxy?.noProxy
  }

-  private val httpRewrites: Map<URI, URI>? by lazy {
-    cliOptions.httpRewrites
-      ?: project?.evaluatorSettings?.http?.rewrites
-      ?: settings.http?.rewrites()
+  protected val httpRewrites: Map<URI, URI>? by lazy {
+    cliOptions.httpRewrites ?: evaluatorSettings?.http?.rewrites ?: settings.http?.rewrites()
  }

-  private val externalModuleReaders: Map<String, PklEvaluatorSettings.ExternalReader> by lazy {
-    (project?.evaluatorSettings?.externalModuleReaders ?: emptyMap()) +
-      cliOptions.externalModuleReaders
+  protected val externalModuleReaders: Map<String, PklEvaluatorSettings.ExternalReader> by lazy {
+    (evaluatorSettings?.externalModuleReaders ?: emptyMap()) + cliOptions.externalModuleReaders
  }

-  private val externalResourceReaders: Map<String, PklEvaluatorSettings.ExternalReader> by lazy {
-    (project?.evaluatorSettings?.externalResourceReaders ?: emptyMap()) +
-      cliOptions.externalResourceReaders
+  protected val externalResourceReaders: Map<String, PklEvaluatorSettings.ExternalReader> by lazy {
+    (evaluatorSettings?.externalResourceReaders ?: emptyMap()) + cliOptions.externalResourceReaders
  }

  private val externalProcesses:
@@ -240,7 +237,7 @@ abstract class CliCommand(protected val cliOptions: CliBaseOptions) {
  }

  private val traceMode: TraceMode by lazy {
-    cliOptions.traceMode ?: project?.evaluatorSettings?.traceMode ?: TraceMode.COMPACT
+    cliOptions.traceMode ?: evaluatorSettings?.traceMode ?: TraceMode.COMPACT
  }

  private fun HttpClient.Builder.addDefaultCliCertificates() {
@@ -16,6 +16,7 @@
 package org.pkl.commons.cli

 import com.github.ajalt.clikt.core.parse
+import com.github.ajalt.clikt.parameters.groups.provideDelegate
 import java.net.URI
 import java.nio.file.Path
 import kotlin.io.path.ExperimentalPathApi
@@ -25,26 +26,44 @@ import org.junit.jupiter.api.Test
 import org.junit.jupiter.api.assertThrows
 import org.junit.jupiter.api.io.TempDir
 import org.pkl.commons.cli.commands.BaseCommand
+import org.pkl.commons.cli.commands.ProjectOptions
+import org.pkl.commons.writeString
 import org.pkl.core.SecurityManagers
+import org.pkl.core.evaluatorSettings.TraceMode
+import org.pkl.core.util.IoUtils

@OptIn(ExperimentalPathApi::class)
 class CliCommandTest {

-  class CliTest(options: CliBaseOptions) : CliCommand(options) {
-    override fun doRun() = Unit
-
-    val myAllowedResources = allowedResources
-    val myAllowedModules = allowedModules
-    val myResolvedSourceModules = resolvedSourceModules
-  }
-
  private val cmd =
    object : BaseCommand("test", "") {
+      val projectOptions: ProjectOptions by ProjectOptions()
+
      override fun run() = Unit

      override val helpString: String = ""
    }

+  class CliTest(options: CliBaseOptions) : CliCommand(options) {
+    override fun doRun() = Unit
+
+    val myResolvedSourceModules = resolvedSourceModules
+    val myAllowedModules = allowedModules
+    val myAllowedResources = allowedResources
+    val myRootDir = rootDir
+    val myModulePath = modulePath
+    val myProxyAddress = proxyAddress
+    val myNoProxy = noProxy
+    val myHttpRewrites = httpRewrites
+    val myExternalModuleReaders = externalModuleReaders
+    val myExternalResourceReaders = externalResourceReaders
+
+    fun myEvaluatorBuilder() = evaluatorBuilder()
+
+    @Suppress("PklCliDirectProjectEvaluatorSettingsAccess")
+    val myProjectEvaluatorSettings = project?.evaluatorSettings
+  }
+
  @Test
  fun `--external-resource-reader and --external-module-reader populate allowed modules and resources`() {
    cmd.parse(
@@ -184,4 +203,81 @@ class CliCommandTest {
    assertThat(cliTest.myResolvedSourceModules)
      .isEqualTo(listOf(tempDir.toUri().resolve("package://example.com/foo@1.2.3#/bar.pkl")))
  }
+
+  val projectWithAllEvaluatorSettings =
+    """
+    amends "pkl:Project"
+    
+    evaluatorSettings {
+      externalProperties { ["foo"] = "bar" }
+      env { ["foo"] = "bar" }
+      allowedModules { "file:" }
+      allowedResources { "file:" }
+      color = "always"
+      noCache = true
+      modulePath { "/tmp/modulepath" }
+      timeout = 30.s
+      moduleCacheDir = "/tmp/cache"
+      rootDir = "/tmp/root"
+      http {
+        proxy {
+          address = "http://example.com:80"
+          noProxy { "example.com" }
+        }
+        rewrites {
+          ["https://example.com/foo/"] = "https://example.com/bar/"
+        }
+      }
+      externalModuleReaders {
+        ["foo"] { executable = "foo" }
+      }
+      externalResourceReaders {
+        ["foo"] { executable = "foo" }
+      }
+      traceMode = "pretty"
+    }
+  """
+      .trimIndent()
+
+  @Test
+  fun `test that --omit-project-settings actually omits project settings`(@TempDir tempDir: Path) {
+    val project = tempDir.resolve("PklProject").writeString(projectWithAllEvaluatorSettings)
+    cmd.parse(arrayOf("--working-dir=$tempDir", "--omit-project-settings"))
+    val opts =
+      cmd.baseOptions.baseOptions(listOf(project.toUri()), cmd.projectOptions, testMode = true)
+    val cliTest = CliTest(opts)
+    val builder = cliTest.myEvaluatorBuilder()
+    assertThat(cliTest.myAllowedModules).isEqualTo(SecurityManagers.defaultAllowedModules)
+    assertThat(cliTest.myAllowedResources).isEqualTo(SecurityManagers.defaultAllowedResources)
+    assertThat(cliTest.myRootDir).isNull()
+    assertThat(builder.environmentVariables).isEqualTo(System.getenv())
+    assertThat(builder.externalProperties).isEmpty()
+    assertThat(builder.moduleCacheDir).isEqualTo(IoUtils.getDefaultModuleCacheDir())
+    assertThat(cliTest.myModulePath).isEmpty()
+    assertThat(builder.color).isFalse
+    assertThat(cliTest.myProxyAddress).isNull()
+    assertThat(cliTest.myNoProxy).isNull()
+    assertThat(cliTest.myHttpRewrites).isNull()
+    assertThat(cliTest.myExternalModuleReaders).isEmpty()
+    assertThat(cliTest.myExternalResourceReaders).isEmpty()
+    assertThat(builder.traceMode).isEqualTo(TraceMode.COMPACT)
+  }
+
+  // hygiene test to ensure new evaluator settings get covered by the above test
+  @Test
+  fun `test project sets all evaluator settings`(@TempDir tempDir: Path) {
+    val project = tempDir.resolve("PklProject").writeString(projectWithAllEvaluatorSettings)
+    cmd.parse(arrayOf("--working-dir=$tempDir"))
+    val opts = cmd.baseOptions.baseOptions(listOf(project.toUri()), testMode = true)
+    val cliTest = CliTest(opts)
+    cliTest.myProjectEvaluatorSettings
+      ?.javaClass
+      ?.declaredMethods
+      ?.filter { it.parameterCount == 0 }
+      ?.forEach {
+        assertThat(it.invoke(cliTest.myProjectEvaluatorSettings))
+          .overridingErrorMessage("project evaluator settings returned null for ${it.name}")
+          .isNotNull
+      }
+  }
 }
@@ -336,6 +336,16 @@ public final class EvaluatorImpl implements Evaluator {
    }
  }

+  // for use in tests to determine whether an evaluator ever triggered instrumentation
+  boolean isInstrumentationEverUsed() {
+    polyglotContext.enter();
+    try {
+      return VmLanguage.get(null).localContext.get().isInstrumentationEverUsed();
+    } finally {
+      polyglotContext.leave();
+    }
+  }
+
  String evaluateOutputText(VmTyped fileOutput) {
    return doEvaluate(() -> VmUtils.readTextProperty(fileOutput));
  }
@@ -44,6 +44,24 @@ public interface SecurityManager {
   */
  void checkResolveResource(URI resource) throws SecurityManagerException;

+  /**
+   * Resolves the given {@code file:} URI to a secure, symlink-free path that has been verified to
+   * be within the root directory (if one is configured). The returned path can be opened with
+   * {@link java.nio.file.LinkOption#NOFOLLOW_LINKS}.
+   *
+   * <p>Returns {@code null} for non-{@code file:} URIs or if no root directory is configured.
+   *
+   * @param uri the URI to resolve
+   * @param isResource denotes if uri belongs to a resource (otherwise, a module)
+   * @return the resolved, symlink-free path under root directory, or {@code null}
+   * @throws SecurityManagerException if the resolved path is not within the root directory
+   * @throws IOException if the path cannot be resolved
+   */
+  default @Nullable Path resolveSecurePath(URI uri, boolean isResource)
+      throws SecurityManagerException, IOException {
+    return null;
+  }
+
  /**
   * Resolves the given {@code file:} URI to a secure, symlink-free path that has been verified to
   * be within the root directory (if one is configured). The returned path can be opened with
@@ -57,6 +75,6 @@ public interface SecurityManager {
   * @throws IOException if the path cannot be resolved
   */
  default @Nullable Path resolveSecurePath(URI uri) throws SecurityManagerException, IOException {
-    return null;
+    return resolveSecurePath(uri, false);
  }
 }
@@ -173,14 +173,20 @@ public final class SecurityManagers {
    }

    @Override
-    public @Nullable Path resolveSecurePath(URI uri) throws SecurityManagerException, IOException {
-      if (rootDir == null || !uri.isAbsolute() || !uri.getScheme().equals("file")) {
+    public @Nullable Path resolveSecurePath(URI uri, boolean isResource)
+        throws SecurityManagerException, IOException {
+      if (rootDir == null
+          || !uri.isAbsolute()
+          || !uri.getScheme().equals("file")
+          || (uri.getAuthority() != null && !uri.getAuthority().isEmpty())) {
        return null;
      }
      var path = Path.of(uri);
      var realPath = path.toRealPath();
      if (!realPath.startsWith(rootDir)) {
-        throw new SecurityManagerException(ErrorMessages.create("modulePastRootDir", uri, rootDir));
+        var errorMessageKey = isResource ? "resourcePastRootDir" : "modulePastRootDir";
+        var message = ErrorMessages.create(errorMessageKey, uri, rootDir);
+        throw new SecurityManagerException(message);
      }
      return realPath;
    }
@@ -225,6 +231,16 @@ public final class SecurityManagers {
      if (rootDir == null || !checkUri.getScheme().equals("file")) return;

      var path = Path.of(checkUri);
+
+      // uri represents a UNC path if authority is non-null
+      // so treat this like a potentially redirected HTTP read:
+      // check if both the given and real paths are under rootDir
+      if (checkUri.getAuthority() != null && !checkUri.getAuthority().isEmpty()) {
+        doCheckIsUnderRootDir(path.normalize(), uri, isResource);
+      }
+      // if given path is under rootDir, do I/O to determine if the real path is under the root dir
+      // this can result in a nasty timeout (~20s) in Files.exists if the server doesn't respond :(
+
      if (Files.exists(path)) {
        try {
          path = path.toRealPath();
@@ -237,6 +253,12 @@ public final class SecurityManagers {
        path = path.normalize();
      }

+      doCheckIsUnderRootDir(path, uri, isResource);
+    }
+
+    private void doCheckIsUnderRootDir(Path path, URI uri, boolean isResource)
+        throws SecurityManagerException {
+      assert rootDir != null;
      if (!path.startsWith(rootDir)) {
        var errorMessageKey = isResource ? "resourcePastRootDir" : "modulePastRootDir";
        var message = ErrorMessages.create(errorMessageKey, uri, rootDir);
@@ -985,22 +985,48 @@ public abstract class TypeNode extends PklNode {
      // escape analysis should remove this allocation in compiled code
      var typeMismatches = new VmTypeMismatchException[elementTypeNodes.length];

+      // disallow power assertions from triggering in case one union member checks successfully
+      var localContext = VmLanguage.get(this).localContext.get();
+      var wasInTypeTest = localContext.isInTypeTest();
+      localContext.setInTypeTest(true);
+
      // Do eager checks (shallow-force) if there are two listings or two mappings represented.
      // (we can't know that `new Listing { 0; "hi" }[0]` fails for `Listing<Int>|Listing<String>`
      // without checking both index 0 and index 1).
      var shouldEagerCheck = shouldEagerCheck();
+      for (var i = 0; i < elementTypeNodes.length; i++) {
+        var elementTypeNode = elementTypeNodes[i];
+        try {
+          var result =
+              shouldEagerCheck
+                  ? elementTypeNode.executeEagerly(frame, value)
+                  : elementTypeNode.executeLazily(frame, value);
+          localContext.setInTypeTest(wasInTypeTest);
+          return result;
+        } catch (VmTypeMismatchException e) {
+          typeMismatches[i] = e;
+        }
+      }
+
+      // all members failed to type check
+      // if enabled, re-execute type checks to generate power assertions
+      localContext.setInTypeTest(wasInTypeTest);
+      if (VmContext.get(this).getPowerAssertionsEnabled()
+          && (!wasInTypeTest || localContext.hasActiveTracker())) {
        for (var i = 0; i < elementTypeNodes.length; i++) {
          var elementTypeNode = elementTypeNodes[i];
          try {
            if (shouldEagerCheck) {
-            return elementTypeNode.executeEagerly(frame, value);
+              elementTypeNode.executeEagerly(frame, value);
            } else {
-            return elementTypeNode.executeLazily(frame, value);
+              elementTypeNode.executeLazily(frame, value);
            }
          } catch (VmTypeMismatchException e) {
            typeMismatches[i] = e;
          }
        }
+      }
+
      throw new VmTypeMismatchException.Union(sourceSection, value, this, typeMismatches);
    }

@@ -1011,14 +1037,36 @@ public abstract class TypeNode extends PklNode {
      // escape analysis should remove this allocation in compiled code
      var typeMismatches = new VmTypeMismatchException[elementTypeNodes.length];

+      // disallow power assertions from triggering in case one union member checks successfully
+      var localContext = VmLanguage.get(this).localContext.get();
+      var wasInTypeTest = localContext.isInTypeTest();
+      localContext.setInTypeTest(true);
+
      for (var i = 0; i < elementTypeNodes.length; i++) {
        // eager checks
        try {
-          return elementTypeNodes[i].executeEagerly(frame, value);
+          var result = elementTypeNodes[i].executeEagerly(frame, value);
+          localContext.setInTypeTest(wasInTypeTest);
+          return result;
        } catch (VmTypeMismatchException e) {
          typeMismatches[i] = e;
        }
      }
+
+      // all members failed to type check
+      // if enabled, re-execute type checks to generate power assertions
+      localContext.setInTypeTest(wasInTypeTest);
+      if (VmContext.get(this).getPowerAssertionsEnabled()
+          && (!wasInTypeTest || localContext.hasActiveTracker())) {
+        for (var i = 0; i < elementTypeNodes.length; i++) {
+          try {
+            elementTypeNodes[i].executeEagerly(frame, value);
+          } catch (VmTypeMismatchException e) {
+            typeMismatches[i] = e;
+          }
+        }
+      }
+
      throw new VmTypeMismatchException.Union(sourceSection, value, this, typeMismatches);
    }
  }
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -220,7 +220,6 @@ final class ExternalReaderProcessImpl implements ExternalReaderProcess {
                    .send(
                        request,
                        (response) -> {
-                          log(response.toString());
                          if (response instanceof InitializeResourceReaderResponse resp) {
                            var spec =
                                resp.spec() == null
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -33,6 +33,7 @@ import org.pkl.core.messaging.Messages.*;
 import org.pkl.core.messaging.ProtocolException;
 import org.pkl.core.module.PathElement;
 import org.pkl.core.resource.Resource;
+import org.pkl.core.util.Nullable;

 final class ExternalResourceResolverImpl implements ExternalResourceResolver {
  private final MessageTransport transport;
@@ -48,15 +49,14 @@ final class ExternalResourceResolverImpl implements ExternalResourceResolver {

  public Optional<Object> read(URI uri) throws IOException {
    var result = doRead(uri);
-    return Optional.of(new Resource(uri, result));
+    return result == null ? Optional.empty() : Optional.of(new Resource(uri, result));
  }

  public boolean hasElement(SecurityManager securityManager, URI elementUri)
      throws SecurityManagerException {
    securityManager.checkResolveResource(elementUri);
    try {
-      doRead(elementUri);
-      return true;
+      return doRead(elementUri) != null;
    } catch (IOException e) {
      return false;
    }
@@ -98,7 +98,7 @@ final class ExternalResourceResolverImpl implements ExternalResourceResolver {
            }));
  }

-  public byte[] doRead(URI baseUri) throws IOException {
+  public byte @Nullable [] doRead(URI baseUri) throws IOException {
    return MessageTransports.resolveFuture(
        readResponses.computeIfAbsent(
            baseUri,
@@ -113,10 +113,8 @@ final class ExternalResourceResolverImpl implements ExternalResourceResolver {
                      if (response instanceof ReadResourceResponse resp) {
                        if (resp.error() != null) {
                          future.completeExceptionally(new IOException(resp.error()));
-                        } else if (resp.contents() != null) {
-                          future.complete(resp.contents());
                        } else {
-                          future.complete(new byte[0]);
+                          future.complete(resp.contents());
                        }
                      } else {
                        future.completeExceptionally(new ProtocolException("unexpected response"));
@@ -519,6 +519,7 @@ public final class ModuleKeys {
    @Override
    public ResolvedModuleKey resolve(SecurityManager securityManager)
        throws IOException, SecurityManagerException {
+      securityManager.checkResolveModule(uri);
      var httpClient = VmContext.get(null).getHttpClient();
      var request = HttpRequest.newBuilder(uri).build();
      var response = httpClient.send(request, BodyHandlers.ofInputStream());
@@ -262,7 +262,7 @@ public final class ResourceReaders {
      // Use resolveSecurePath to get a symlink-free path verified under rootDir.
      var securityManager = VmContext.get(null).getSecurityManager();
      try {
-        var securePath = securityManager.resolveSecurePath(uri);
+        var securePath = securityManager.resolveSecurePath(uri, true);
        if (securePath != null) {
          try (var in = Files.newInputStream(securePath, LinkOption.NOFOLLOW_LINKS)) {
            var content = in.readAllBytes();
@@ -32,7 +32,6 @@ import java.util.Set;
 import java.util.function.BiFunction;
 import java.util.function.Function;
 import java.util.function.Supplier;
-import java.util.stream.Collectors;
 import org.graalvm.collections.EconomicMap;
 import org.pkl.core.CommandSpec;
 import org.pkl.core.CommandSpec.Argument;
@@ -408,7 +407,6 @@ public final class CommandSpecParser {
      } else if (typeNode instanceof TypeNode.TypeAliasTypeNode typeAliasTypeNode) {
        if (typeAliasTypeNode.getVmTypeAlias() == BaseModule.getCharTypeAlias()) break;
        typeNode = typeAliasTypeNode.getAliasedTypeNode();
-        break;
      } else {
        break;
      }
@@ -771,18 +769,18 @@ public final class CommandSpecParser {
        return true;
      } else if (typeNode
          instanceof TypeNode.UnionOfStringLiteralsTypeNode unionOfStringLiteralsTypeNode) {
-        var choices = unionOfStringLiteralsTypeNode.getStringLiterals().stream().sorted();
+        var choices = unionOfStringLiteralsTypeNode.getStringLiterals().stream().sorted().toList();
        if (each == null)
          each =
              (rawValue, workingDirUri) -> {
                if (!unionOfStringLiteralsTypeNode.getStringLiterals().contains(rawValue)) {
-                  throw BadValue.invalidChoice(rawValue, choices.toList());
+                  throw BadValue.invalidChoice(rawValue, choices);
                }
                return rawValue;
              };
        if (all == null) all = this::allChooseLast;
        if (multiple == null) multiple = false;
-        if (metavar == null) metavar = "[" + choices.collect(Collectors.joining(", ")) + "]";
+        if (metavar == null) metavar = "[" + String.join(", ", choices) + "]";
        if (completionCandidates == null)
          completionCandidates = new Fixed(unionOfStringLiteralsTypeNode.getStringLiterals());
        return true;
@@ -34,7 +34,7 @@ import org.pkl.parser.syntax.Module;
@TruffleLanguage.Registration(
    id = "pkl",
    name = "Pkl",
-    version = "0.31.0-dev",
+    version = "0.31.1",
    characterMimeTypes = VmLanguage.MIME_TYPE,
    contextPolicy = ContextPolicy.SHARED)
@ProvidedTags(PklTags.Expression.class)
@@ -28,6 +28,8 @@ public class VmLocalContext {
   */
  private int activeTrackerDepth = 0;

+  private boolean instrumentationEverUsed = false;
+
  public VmLocalContext() {}

  public void shouldEagerTypecheck(boolean shouldEagerTypecheck) {
@@ -48,6 +50,7 @@ public class VmLocalContext {

  public void enterTracker() {
    activeTrackerDepth++;
+    instrumentationEverUsed = true;
  }

  public void exitTracker() {
@@ -57,4 +60,8 @@ public class VmLocalContext {
  public boolean hasActiveTracker() {
    return activeTrackerDepth > 0;
  }
+
+  public boolean isInstrumentationEverUsed() {
+    return instrumentationEverUsed;
+  }
 }
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -18,11 +18,13 @@ package org.pkl.core.runtime;
 import com.oracle.truffle.api.CompilerDirectives.CompilationFinal;
 import com.oracle.truffle.api.CompilerDirectives.TruffleBoundary;
 import com.oracle.truffle.api.frame.MaterializedFrame;
+import com.oracle.truffle.api.instrumentation.InstrumentableNode.WrapperNode;
 import org.graalvm.collections.EconomicMap;
 import org.graalvm.collections.UnmodifiableEconomicMap;
 import org.pkl.core.Composite;
 import org.pkl.core.PModule;
 import org.pkl.core.PObject;
+import org.pkl.core.ast.ExpressionNode;
 import org.pkl.core.ast.expression.unary.ImportNode;
 import org.pkl.core.ast.member.ObjectMember;
 import org.pkl.core.util.EconomicMaps;
@@ -103,9 +105,11 @@ public final class VmTyped extends VmObject {
      if (member.isImport()) {
        var memberNode = member.getMemberNode();
        assert memberNode != null; // import is never a constant
-        builder.add(
-            member.getName().toString(),
-            ((ImportNode) memberNode.getBodyNode()).getImportUri().toString());
+        var bodyNode = memberNode.getBodyNode();
+        if (bodyNode instanceof WrapperNode wrapper) {
+          bodyNode = (ExpressionNode) wrapper.getDelegateNode();
+        }
+        builder.add(member.getName().toString(), ((ImportNode) bodyNode).getImportUri().toString());
      }
    }
    return builder.build();
@@ -0,0 +1,15 @@
+import "pkl:reflect"
+import "pkl:test"
+
+class Foo {
+  bar: String(startsWith("a"))
+}
+
+// regression test for VmTyped.getImports()
+// which walks module members that are imports and casts their bodies to ImportNode
+// the catch activates instrumentation by failing a constraint check
+// so that the reflected import member bodies are wrapper nodes instead of ImportNode directly
+// the fix for this unwraps the wrapper before casting to ImportNode
+foo =
+  let (_ = test.catchOrNull(() -> new Foo { bar = "baz" }.bar))
+    reflect.Module(module).imports
@@ -0,0 +1 @@
+foo = Map("reflect", "pkl:reflect", "test", "pkl:test")
@@ -22,6 +22,7 @@ import java.nio.file.FileSystems
 import java.nio.file.Files
 import java.nio.file.Path
 import java.util.*
+import java.util.concurrent.TimeUnit
 import java.util.regex.Pattern
 import kotlin.io.path.createParentDirectories
 import kotlin.io.path.writeText
@@ -29,7 +30,10 @@ import org.assertj.core.api.Assertions.assertThat
 import org.assertj.core.api.Assertions.assertThatCode
 import org.junit.jupiter.api.AfterAll
 import org.junit.jupiter.api.Test
+import org.junit.jupiter.api.Timeout
 import org.junit.jupiter.api.assertThrows
+import org.junit.jupiter.api.condition.EnabledOnOs
+import org.junit.jupiter.api.condition.OS
 import org.junit.jupiter.api.io.TempDir
 import org.pkl.commons.createTempFile
 import org.pkl.commons.test.PackageServer
@@ -540,6 +544,91 @@ class EvaluatorTest {
    }
  }

+  @Test
+  @EnabledOnOs(OS.WINDOWS)
+  @Timeout(1, unit = TimeUnit.SECONDS)
+  fun `root dir check happens without any UNC or SMB access`() {
+    val evaluator =
+      with(EvaluatorBuilder.preconfigured()) {
+        rootDir = Path.of("/tmp/test")
+        build()
+      }
+    // this uses a TEST-NET-1 IP which has no server running in order to force a timeout-driven
+    // failure (takes ~20s)
+    // root dir check failure should prevent any I/O and fail fast instead of hitting the timeout
+    val exc =
+      assertThrows<PklException> {
+        evaluator.evaluate(text("result = import(\"file://192.0.2.1/share/nope.pkl\")"))
+      }
+    assertThat(exc)
+      .hasMessageContaining(
+        "Refusing to load module `file://192.0.2.1/share/nope.pkl` because it is not within the root directory (`--root-dir`)."
+      )
+  }
+
+  @Test
+  fun `constraint failures activate instrumentation`() {
+    val evaluator =
+      with(EvaluatorBuilder.preconfigured()) {
+        powerAssertionsEnabled = true
+        build()
+      }
+
+    val exc =
+      assertThrows<PklException> {
+        evaluator.evaluate(
+          text(
+            """
+    foo: String(chars.first == "a") = "boo"
+    """
+              .trimIndent()
+          )
+        )
+      }
+
+    assertThat((evaluator as EvaluatorImpl).isInstrumentationEverUsed()).isTrue
+  }
+
+  @Test
+  fun `union single-member constraint failures do not activate instrumentation`() {
+    val evaluator =
+      with(EvaluatorBuilder.preconfigured()) {
+        powerAssertionsEnabled = true
+        build()
+      }
+
+    evaluator.evaluate(
+      text(
+        """
+    foo: String(startsWith("a")) | String(startsWith("b")) | String(startsWith("c")) = "cool"
+    """
+          .trimIndent()
+      )
+    )
+
+    assertThat((evaluator as EvaluatorImpl).isInstrumentationEverUsed()).isFalse
+  }
+
+  @Test
+  fun `type test failures do not activate instrumentation`() {
+    val evaluator =
+      with(EvaluatorBuilder.preconfigured()) {
+        powerAssertionsEnabled = true
+        build()
+      }
+
+    evaluator.evaluate(
+      text(
+        """
+    foo = "bar" is Int(this > 0)
+    """
+          .trimIndent()
+      )
+    )
+
+    assertThat((evaluator as EvaluatorImpl).isInstrumentationEverUsed()).isFalse
+  }
+
  private fun checkModule(module: PModule) {
    assertThat(module.properties.size).isEqualTo(2)
    assertThat(module.getProperty("name")).isEqualTo("pigeon")
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -20,6 +20,7 @@ import java.net.MalformedURLException
 import java.net.URI
 import java.net.URISyntaxException
 import java.nio.file.Path
+import java.util.regex.Pattern
 import kotlin.io.path.createFile
 import kotlin.io.path.createParentDirectories
 import org.assertj.core.api.Assertions.assertThat
@@ -28,6 +29,7 @@ import org.junit.jupiter.api.assertThrows
 import org.junit.jupiter.api.io.TempDir
 import org.pkl.commons.toPath
 import org.pkl.commons.writeString
+import org.pkl.core.SecurityManagerException
 import org.pkl.core.SecurityManagers

 class ModuleKeysTest {
@@ -207,6 +209,27 @@ class ModuleKeysTest {
    assertThat(e).hasMessageContaining("Package URIs must have a path component")
  }

+  @Test
+  fun `http - resolve obeys allowed modules`() {
+    val uri = URI("https://apple.com/some/foo.pkl")
+    val key = ModuleKeys.genericUrl(uri)
+
+    assertThat(key.uri).isEqualTo(uri)
+    assertThat(key.isCached).isTrue
+
+    assertThat(ModuleKeys.isStdLibModule(key)).isFalse
+    assertThat(ModuleKeys.isBaseModule(key)).isFalse
+
+    assertThrows<SecurityManagerException> {
+      key.resolve(
+        with(SecurityManagers.standardBuilder()) {
+          setAllowedModules(listOf(Pattern.compile("repl:"), Pattern.compile("file:")))
+          build()
+        }
+      )
+    }
+  }
+
  @Test
  fun `generic URL`() {
    val uri = URI("https://apple.com/some/foo.pkl")
@@ -787,4 +787,55 @@ class CommandSpecParserTest {
      .contains("Option `foo` with annotation `@CountedFlag` has invalid type `String`.")
    assertThat(exc.message).contains("Expected type: `Int`")
  }
+
+  @Test
+  fun `union typed option validates invalid choice without stream error`() {
+    val moduleUri =
+      writePklFile(
+        "cmd.pkl",
+        renderOptions +
+          """
+      class Options {
+        format: "json" | "yaml" | "toml"
+      }
+    """
+            .trimIndent(),
+      )
+
+    val spec = parse(moduleUri)
+    val flag = spec.options.first() as CommandSpec.Flag
+
+    assertThat(flag.metavar()).isEqualTo("[json, toml, yaml]")
+
+    val apply =
+      assertThrows<CommandSpec.Option.BadValue> {
+        flag.transformEach().apply("xml", URI("file:///tmp"))
+      }
+    assertThat(apply.message).contains("invalid choice")
+    assertThat(apply.message).contains("xml")
+  }
+
+  @Test
+  fun `typealias of nullable is resolved as optional`() {
+    val moduleUri =
+      writePklFile(
+        "cmd.pkl",
+        renderOptions +
+          """
+      typealias OptionalString = String?
+      class Options {
+        foo: OptionalString
+      }
+    """
+            .trimIndent(),
+      )
+
+    val spec = parse(moduleUri)
+
+    assertThat(spec.options.toList()[0]).isInstanceOf(CommandSpec.Flag::class.java)
+    (spec.options.toList()[0] as CommandSpec.Flag).apply {
+      assertThat(this.name).isEqualTo("foo")
+      assertThat(this.showAsRequired).isFalse()
+    }
+  }
 }
@@ -36,7 +36,7 @@
 ///
 /// Warning: Although this module is ready for initial use,
 /// benchmark results may be inaccurate or inconsistent.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.Benchmark

 import "pkl:platform" as _platform
@@ -29,7 +29,7 @@
 ///   // ...
 /// }
 /// ```
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 open module pkl.Command

 import "pkl:Command"
@@ -63,7 +63,7 @@
 /// @Deprecated { message = "Use `com.example.Birds.Parrot` instead" }
 /// amends "pkl:PackageInfo"
 /// ```
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.DocPackageInfo

 // used by doc comments
@@ -31,7 +31,7 @@
 ///
 /// title = "Title displayed in the header of each page"
 /// ```
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.DocsiteInfo

 import "pkl:reflect"
@@ -15,7 +15,7 @@
 //===----------------------------------------------------------------------===//

 /// Common settings for Pkl's own evaluator.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
@Since { version = "0.26.0" }
 module pkl.EvaluatorSettings

@@ -64,7 +64,7 @@
 ///   value = project
 /// }
 /// ``` 
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.Project

 import "pkl:EvaluatorSettings" as EvaluatorSettingsModule
@@ -19,7 +19,7 @@
 /// These tools differentiate from [pkl:reflect][reflect] in that they parse Pkl modules, but do not
 /// execute any code within these modules.
@Since { version = "0.27.0" }
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.analyze

 // used by doc comments
@@ -17,7 +17,7 @@
 /// Fundamental properties, methods, and classes for writing Pkl programs.
 ///
 /// Members of this module are automatically available in every Pkl module.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.base

 // json, math, and yaml imports used for doc comments
@@ -15,7 +15,7 @@
 //===----------------------------------------------------------------------===//

 /// A JSON parser.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.json

 /// Annotate properties of classes and modules with this class to override how a [JsonRenderer]
@@ -15,7 +15,7 @@
 //===----------------------------------------------------------------------===//

 /// A [Jsonnet](https://jsonnet.org) renderer.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.jsonnet

 /// Constructs an [ImportStr].
@@ -18,7 +18,7 @@
 ///
 /// Note that some mathematical functions, such as `sign()`, `abs()`, and `round()`,
 /// are directly defined in classes [Number], [Int], and [Float].
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.math

 /// The minimum [Int] value: `-9223372036854775808`.
@@ -28,7 +28,7 @@
 /// The `pkl-binary` format uses MessagePack encoding.
 /// Its specification is available at
 /// <https://pkl-lang.org/main/current/bindings-specification/binary-encoding.html>.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.pklbinary

 /// Render values as `pkl-binary`.
@@ -15,7 +15,7 @@
 //===----------------------------------------------------------------------===//

 /// Information about the platform that the current program runs on.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.platform

 /// The platform that the current program runs on.
@@ -16,7 +16,7 @@

 /// A renderer for [Protocol Buffers](https://developers.google.com/protocol-buffers).
 /// Note: This module is _experimental_ and not ready for production use.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.protobuf

 import "pkl:reflect"
@@ -26,7 +26,7 @@
 /// - Documentation generators (such as *Pkldoc*)
 /// - Code generators (such as *pkl-codegen-java* and *pkl-codegen-kotlin*)
 /// - Domain-specific schema validators
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.reflect

 import "pkl:base"
@@ -15,7 +15,7 @@
 //===----------------------------------------------------------------------===//

 /// Information about the Pkl release that the current program runs on.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.release

 import "pkl:semver"
@@ -15,7 +15,7 @@
 //===----------------------------------------------------------------------===//

 /// Parsing, comparison, and manipulation of [semantic version](https://semver.org/spec/v2.0.0.html) numbers.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.semver

 /// Tells whether [version] is a valid semantic version number.
@@ -19,7 +19,7 @@
 /// Every settings file must amend this module.
 /// Unless CLI commands and build tool plugins are explicitly configured with a settings file,
 /// they will use `~/.pkl/settings.pkl` or the defaults specified in this module.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.settings

 import "pkl:EvaluatorSettings"
@@ -15,7 +15,7 @@
 //===----------------------------------------------------------------------===//

 /// Utilities for generating shell scripts.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.shell

 /// Escapes [str] by enclosing it in single quotes.
@@ -18,7 +18,7 @@
 ///
 /// To write tests, amend this module and define [facts] or [examples] (or both).
 /// To run tests, use the `pkl test` command to evaluate the amended module.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 open module pkl.test

 /// Named groups of boolean expressions that are expected to evaluate to [true].
@@ -15,7 +15,7 @@
 //===----------------------------------------------------------------------===//

 /// An XML renderer.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.xml

 /// Renders values as XML.
@@ -15,7 +15,7 @@
 //===----------------------------------------------------------------------===//

 /// A YAML 1.2 compliant YAML parser.
-@ModuleInfo { minPklVersion = "0.31.0" }
+@ModuleInfo { minPklVersion = "0.31.1" }
 module pkl.yaml

 /// Annotate properties of classes and modules with this class to override how a [YamlRenderer]
Author	SHA1	Message	Date
Jen Basch	efc9e2c819	Prepare 0.31.1 release	2026-03-26 09:08:16 -07:00
Jen Basch	a9544ebbaf	Add 0.31.1 changelog (#1473 ) Closes #1472 Co-authored-by: Islon Scherer <i_desouzascherer@apple.com>	2026-03-26 09:02:12 -07:00
Islon Scherer	0eb619b387	Disable gradle cache for release builds (#1474 )	2026-03-26 09:01:52 -07:00
Jen Basch	2c74108a6a	Do not activate power assertions when a single union member containing a type constraint fails (#1462 ) Prior to this change, this code would activate powers assertions / instrumentation permanently: ```pkl foo: String(contains("a")) \| String(contains("b")) = "boo" ``` This is because the `contains("a")` constraint would fail, triggering power assertions, but the subsequent check of the union's `contains("b")` branch would succeed. As observed in #1419, once instrumentation is enabled, all subsequent evaluation slows significantly. As with #1419, the fix here is to disable power assertions via `VmLocalContext` until we know that all union members failed type checking; then, each member is re-executed with power assertions allowed to provide the improved user-facing error.	2026-03-25 12:13:21 -07:00
Jen Basch	bd914f266a	Prevent `--multiple-file-output-path` writes from following symlinks outside the target directory (#1467 )	2026-03-25 12:13:13 -07:00
Jen Basch	c069fb9611	Prevent I/O when checking UNC paths against `--root-dir` (#1466 ) Test on [windows] please	2026-03-25 12:12:36 -07:00
Jen Basch	b1fa8bea32	Allow custom/external resources to be "not found" (#1471 ) This allows custom/external resources to produce `null` values for nullable reads (`read?`) Ref: https://github.com/apple/pkl-go/issues/157	2026-03-25 12:12:31 -07:00
Jen Basch	3bdadb0bcd	Correct SecurityManager check for HTTP(S) module URIs (#1463 )	2026-03-25 12:12:24 -07:00
Jen Basch	4f33a7e521	Fix module reflection when instrumentation is active (#1464 )	2026-03-25 12:12:15 -07:00
dependabot[bot]	51dc0dc14d	Bump actions/create-github-app-token from 2.2.1 to 2.2.2 (#1469 )	2026-03-25 12:12:01 -07:00
Jen Basch	3a91a51c5f	Bump pkl.impl.ghactions to version 1.5.0 (#1460 )	2026-03-25 12:11:54 -07:00
Jen Basch	c4c0325268	Respect `--omit-project-settings` for all evaluator options (#1459 )	2026-03-25 12:11:47 -07:00
dependabot[bot]	58d0fc2e05	Bump gradle/actions from 5.0.1 to 5.0.2 (#1456 )	2026-03-25 12:11:26 -07:00
Kushal Pisavadia	0f054d5c10	Fix command `typealias` unwrapping in `resolveType` (#1449 ) The loop unwraps nullables and constraints but breaks straight away after a `typealias`. This means the nullable is missed. Removing the `break` fixes it. ## Exception ``` org.pkl.core.PklException: –– Pkl Error –– Command option property `foo` has unsupported type `String?`. 11 \| foo: OptionalString ^^^^^^^^^^^^^^^^^^^ at <unknown> (file:///var/folders/xh/lmp1n6qj4m13t53cfmbqnkwh0000gn/T/junit-1378070630576324311/cmd.pkl) Use a supported type or define a transformEach and/or transformAll function ```	2026-03-25 12:11:07 -07:00
Kushal Pisavadia	9315b8410d	Fix stream double-consumption in `CommandSpecParser` (#1448 ) The `choices` stream was consumed eagerly for metavar construction, then captured in a lambda for later validation—which promptly fell over with `IllegalStateException`. Materialise to a `List` straightaway.	2026-03-25 12:10:57 -07:00
layla	853ac26e44	Fix typo: recieve to receive (#1455 )	2026-03-02 09:44:58 -08:00
Jen Basch	40ee6c6124	Fix typo in 0.31 release notes (#1450 )	2026-02-27 13:18:36 -08:00
Jen Basch	e8ecc17709	Fix 0.31 release date in changelog	2026-02-26 11:09:54 -08:00
Islon Scherer	2904b719bb	Prepare 0.31.0 release	2026-02-26 18:13:41 +01:00
				`@@ -0,0 +1 @@`
				`foo = Map("reflect", "pkl:reflect", "test", "pkl:test")`