search

spohlenz / tinymce-rails

Integration of TinyMCE with the Rails asset pipeline
Other
813 stars 256 forks source link

Any big reason to yank version 7.1.1 released 3 weeks ago? #314

Closed oboxodo closed 2 weeks ago

oboxodo commented 2 weeks ago

Hi there. Today we had a production deployment halted because at the time of installing the gems in the new servers we had v7.1.1 in Gemfile.lock but it wasn't found in rubygems.org.

I understand you guys released v7.1.2.1 and yanked both 7.1.1 and 7.1.2. There's no changelog or history file but looking at commits history I found this comment: https://github.com/spohlenz/tinymce-rails/pull/313#issuecomment-2167191193

So I wonder if yanking those versions was actually necessary or not, considering we might not be the only ones already depending on one of those versions. IIUC the only problem with those versions was that they included unneeded files in the gem, so it's not like they included a trojan or some important security flaw.

This was easy to resolve on our end by reverting to the previous 7.1.0 version until we have time to test with the new 7.1.2.1 version next few days... but it did cause some havoc and we wanted to let you know because we guess it could've affected someone else too.

Again, I'm not against yanking faulty builds when they're dangerous or even in this case if the release was fresh from the day... I just think the problem is that 3 weeks after release means a lot of people might've updated already.

Thanks!

spohlenz commented 2 weeks ago

In hindsight, yanking the bulky gem releases was almost certainly an overreaction to the issue. I'll reconsider against doing that in future.