External Publication
Visit Post

Yanking a crate better than deleting it

Rust Internals [Unofficial] April 15, 2026
Source
I think there should be an option on crates.io to forbid new releases which are semver-compatible with existing crate releases (maybe with some warning for downstream users). You could use it before transferring ownership, thus preventing new owner from publishing malicious patch releases which would be consumed automatically by downstream.

Discussion in the ATmosphere

Loading comments...