-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Hey,
Recently upstream of "futures" crate yanked all 0.2 releases and pushed them as "futures-preview". I wonder what we should do in regard to this…
Also there is no way to get automatic notifications whether upstream has yanked something, we probably want to build some automation in anitya.
Thoughts?
Igor Gnatenko:
Hey,
Recently upstream of "futures" crate yanked all 0.2 releases and pushed them as "futures-preview". I wonder what we should do in regard to this…
Also there is no way to get automatic notifications whether upstream has yanked something, we probably want to build some automation in anitya.
Thoughts?
AFAIU yanking just means that no new crates can be published that depend on it, but old crates that still depend on it will still be able to access it in order to satisfy the dependency requirements. Distros should just be able to ignore the yanking?
X
On Sun, Jul 1, 2018 at 8:10 PM Ximin Luo infinity0@debian.org wrote:
Igor Gnatenko:
Hey,
Recently upstream of "futures" crate yanked all 0.2 releases and pushed them as "futures-preview". I wonder what we should do in regard to this…
Also there is no way to get automatic notifications whether upstream has yanked something, we probably want to build some automation in anitya.
Thoughts?
AFAIU yanking just means that no new crates can be published that depend on it, but old crates that still depend on it will still be able to access it in order to satisfy the dependency requirements. Distros should just be able to ignore the yanking?
Yes, but I wonder if it's what we want to do. Some upstreams will move into using futures-preview from now on and I wonder if we should package -preview versions and having symlinks or...?
On 07/01/2018 12:10 PM, Ximin Luo wrote:
Igor Gnatenko:
Hey,
Recently upstream of "futures" crate yanked all 0.2 releases and pushed them as "futures-preview". I wonder what we should do in regard to this…
Also there is no way to get automatic notifications whether upstream has yanked something, we probably want to build some automation in anitya.
Thoughts?
AFAIU yanking just means that no new crates can be published that depend on it, but old crates that still depend on it will still be able to access it in order to satisfy the dependency requirements. Distros should just be able to ignore the yanking?
Often yanking means there was a serious problem with that release. I think in most cases that would be followed by a fixed release, so the distro could just update further, but it would still be nice for us to have some notification that this happened.