unpublish a package

[j3k0]

I published a package with an incorrect name (feathersui-starling-compat).

How do I unpublish it? I guess there's an API (is there?) apm should probably have a command for that.

[marchbold]

So we made a decision, not to allow "unpublishing" initially. This is by choice as removing a package can have a knock on effect if other packages are dependent on it.

We do plan to add an "unpublish" procedure (along with a "deprecate" procedure) if the package meets certain criteria (no dependent packages) but this has not been implemented as yet. We wanted to get all the processes for defining dependencies in place before tackling this.

You will have to manually remove it from your database currently.

[marchbold]

We were almost going to take the same approach as flutter ("Publishing is forever"), but I think an unpublish process will be useful in the future.

[j3k0]

"unpublishing" could keep the package in database, so it can still be used if referenced from other packages or projects, but be excluded from search.

At a more granular level, with node's npm I sometime had to unpublish a version when a major bug is discovered too late (after having published it), this way people using latest will get the earlier (non-buggy) version. Although this can also be done with reverting some changes and making a new version.

--

A more general solution could be a "status" attached to each version of a package in the repository:

"status": "prerelease" | "release" | "rejected"

• "prerelease": only used by apm when --allow-prerelease is as an option (a package could be published as a prerelease, then promoted to release)
• "release": the default, searchable and install-able
• "rejected": not-searchable still install-able if referenced.

[marchbold]

Don't mind the idea of adding a "status", we do actually have a flag in the database for something similar so had planned something along these lines, but this is a good use for it. Will scope this out.

It's worth using the local package install to check a package before publishing too.

Also, note, you can currently "republish" the same version if you require, if you believe not many people have installed it. Not something we'd advise generally but this could be a solution for a major bug discovered shortly after publishing.