Add "Yank" Feature for Individual Releases

composer / packagist

Package Repository Website - try https://packagist.com if you need your own -

https://packagist.org/

MIT License

1.74k stars 477 forks source link

Add "Yank" Feature for Individual Releases #152

Open chadfennell opened 12 years ago

chadfennell commented 12 years ago

As per @Seldaek's suggestion, I am adding a request to explore an implementation version of the "yank" feature offered on rubygems.org.

This feature does not map nicely to packagist.org, but offers some basic feature ideas that may be of use. E.g.:

Allow users to yank previous releases such that running composer commands does not trigger an update to yanked versions (e.g. you made a botched release, prevent users from upgrading to this)
Identify yanked versions as having been yanked on package page (but leave a download link for posterity)
Offer a mechanism to undo a yank
These rubygems yank features are demoed in this video

Rather than offering a CLI mechanism, these features could simply exist in the packagist UI.

While this does not solve the related Issues of package deletion: (e.g. #25 #115), it does at least offer a means to pull specific releases.

nicolas-grekas commented 7 years ago

Note also that it would useful to yank not only individual releases but also e.g. <2.0.0. This could be a way to fix the current scalability issue packagist is about to have (having an ever increasing list of package versions to deal with).

naderman commented 7 years ago

@nicolas-grekas Certainly the solution to that is not to yank all older packages that someone may still want to use somewhere? This is a solution to deleting individual botched releases, not a mechanism to delete everything but the latest release. In fact I would try and safe-guard from it being used for that so users don't get failures for no good reason. I would very much like to still be able to install a Symfony 2.0 release somewhere locally for historic or investigative debugging purposes, no need to make that impossible.

christian-weiss commented 7 years ago

The feature is good. But can we please have another name for it?!

"Cancel" a release: as Atlassian do (Jira, etc.). See an example https://confluence.atlassian.com/jirasoftware/jira-software-7-0-x-release-notes-776997721.html

"Revoke" a release or version, as Hashicorp Atlas do (Vagrant boxes, virtual machines). Documentation: https://atlas.hashicorp.com/help/vagrant/boxes/lifecycle

naderman commented 7 years ago

I'd prefer cancel or revoke, too.