Re:Urgent Upcoming OpenSSL release patches critical vulnerab...
by justinjlynn on Saturday October 29, 2022 @05:14AM
(#33382358)
Yanking crates makes them entirely unavailable for downstream users unless they've already locked the yanked version locally. This breaks dependencies and unlocked builds. Yanking crates is a last resort measure (a fundamentally broken release or a release for which you've issued a security advisory) and not something which should be done trivially regardless of whether or not it breaks all of your users for reasons related only to one's own conflicts of interest (i.e. You won't support it because the person asking you doesn't have a support contract). The author is most certainly entitled to be blunt about their support policy. They are not entitled to disregard community conventions when using community provided package hosting services.
Re:Urgent Upcoming OpenSSL release patches critical vulnerab...
by stoplying1 on Saturday October 29, 2022 @10:36AM
(#33384378)
So, even though it's a convention, and a supported action, it's taboo for them to yank.
Meanwhile, it's apparently such a sin because of people... That don't bother to lock their deps with a Cargo.lock? And that's not breaking an important convention?
Don't know what 'yanking' a crate means specifically, but that seems like an ecosystem problem; in Java for example, maven dependencies are supposed to be immutable and the largest distributor (mvnrepository) doesn't allow updating a package.