Skip to content

Support yank a package with a message #9193

Open

Description

As we proposed in https://rust-lang.github.io/rust-project-goals/2024h2/yank-crates-with-a-reason.html.
We want to allow other owners to yank a package with a message.

The motivation here is that when a crate is updated to address a critical issue — such as a fix for a soundness bug or a security vulnerability—it is beneficial to yank previous versions and prompts users to upgrade with a yank reason. Additionally, if a crate is renamed or deprecated, the yank message can provide guidance on the new recommended crate or version. This ensures that users are aware of necessary updates and can maintain the security and stability of their projects.

So in crates.io, we need to at least support passing a message to the yank API.

I believe we should begin with a simple, length-limited plain text first. But we should also consider the extensibility to allow us to support more structured messages.

  • Add support to the crates.io's yank API
  • Add support on the browser frontend for giving a reason
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

Labels

Projects

  • Status

    For next meeting

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions