Maybe everyone else is too young to remember left-pad, but in the wake of left-pad everyone learned that one of the primary selling points of dedicated dependency repositories is that they can refuse to support "unpublishing" a dependency, which is not a guarantee that Github (or any other popular forge) makes.
I think it's implied to be refusing to unpublish at the request of the author; unpublishing due to outside forces is probably inevitable. If some unsupportable content got introduced in a new version (e.g. xz), at least the historical versions would be kept.
That of course brings in questions of cost, trust, and governance, so there's definitely a trade-off…
Comments
Maybe everyone else is too young to remember left-pad, but in the wake of left-pad everyone learned that one of the primary selling points of dedicated dependency repositories is that they can refuse to support "unpublishing" a dependency, which is not a guarantee that Github (or any other popular forge) makes.
There's no such thing as refusing to unpublish, not if you want to avoid prison time.
Package contains child porn, what now?
I think it's implied to be refusing to unpublish at the request of the author; unpublishing due to outside forces is probably inevitable. If some unsupportable content got introduced in a new version (e.g. xz), at least the historical versions would be kept.
That of course brings in questions of cost, trust, and governance, so there's definitely a trade-off…
It wasn't that long ago...
In the AI age, 6 months seems to be percieved as a long time ago. 6 months feels like yesterday to me.
Ten years as of March 22...