Pkg adds incorrect Artifacts version based on `julia_version`

[IanButterworth]

See JuliaPackaging/Yggdrasil#12226 (comment)

Claude's assessment:

---

Artifacts Version Confusion with julia_version Parameter

Issue Summary

When BinaryBuilder uses Pkg with a specific julia_version parameter, Pkg incorrectly installs Artifacts v1.3.0 from the standalone repository instead of treating it as a bundled standard library.

Reference: JuliaPackaging/Yggdrasil#12226

Root Cause

Artifacts has an unusual version history:

Julia Version	Status	Version	Source
< 1.6	Not stdlib	-	N/A
1.6 - 1.10	Stdlib	nothing	Bundled in julia repo
1.11+	Stdlib	v1.11.0+	Bundled in julia repo (stdlib/Artifacts)
Registry	Package	v1.3.0	https://github.com/JuliaPackaging/Artifacts.jl

The Problem

When resolving for Julia 1.6-1.10, Pkg sees:

• Artifacts is a stdlib with version = nothing (from HistoricalStdlibVersions)
• Artifacts v1.3.0 exists in the General registry

The lack of version information creates ambiguity. Pkg sometimes falls back to the registry version instead of recognizing Artifacts should remain a stdlib.

The confusion is compounded by Artifacts existing in two places:

• External repository: https://github.com/JuliaPackaging/Artifacts.jl (v1.3.0, registered in General)
• Vendored in Julia: stdlib/Artifacts in the main Julia repository (unversioned in 1.6-1.10, versioned in 1.11+)

Pkg's resolver must determine whether a package with UUID 56f22d72-fd6d-98f1-02f0-08ddc0907c33 should be:

1. The stdlib (correct for Julia 1.6+)
2. The external package (v1.3.0 from registry - incorrect for Julia 1.6+)

When version = nothing provides no constraints to match, the resolver can mistakenly select the external v1.3.0.

Example from build logs:

[56f22d72] + Artifacts v1.3.0 [loaded: v1.11.0]

Why BinaryBuilder is Affected

1. BinaryBuilder is being trialed on Julia 1.12+ with Artifacts v1.11.0 loaded
2. Resolves dependencies for older Julia versions (e.g., 1.10)
3. Pkg sees Artifacts as stdlib with version = nothing for Julia 1.10
4. Ambiguity leads Pkg to install v1.3.0 from registry instead

Impact

• BinaryBuilder builds fail or behave unexpectedly
• Wrong Artifacts version (v1.3.0 vs bundled stdlib)
• Affects cross-version dependency resolution

Potential Solutions

1. Improve stdlib resolution: Never fall back to registry for packages that are stdlibs in target Julia version
2. Better disambiguation: Clearer rules for version = nothing stdlibs
3. Add warnings: Detect and warn about stdlib/registry confusion

Related Code

• Pkg.jl/src/Types.jl: is_stdlib(), stdlib_version(), get_last_stdlibs()
• HistoricalStdlibVersions.jl/src/version_map.jl: Shows Artifacts with version = nothing for Julia 1.6-1.10