# Handling End-of-life of a version **URL:** \ **Category:** tools and infrastructure\ **Created:** [October 29, 2015, 7:00am UTC](https://internals.rust-lang.org/t/handling-end-of-life-of-a-version/2848 "2015-10-29T07:00:53Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![briansmith](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/briansmith/32/1306_2.png) [@briansmith](https://internals.rust-lang.org/u/briansmith)\ **Post date:** [October 29, 2015, 7:00am UTC](https://internals.rust-lang.org/t/handling-end-of-life-of-a-version/2848/1 "2015-10-29T07:00:53Z")
Let’s say I publish create Foo 1.0.0 on [crates.io](http://crates.io). Then, after some time, I publish 2.0.0, incompatible with Foo 1.0.0, and I don’t want to, or can’t, support 1.0.0 any more. Then, let’s say there is a critical security bug in Foo 1.0.0 so nobody should use it. [crates.io](http://crates.io) supports “yanking” a package, which handles the case for new crates that try to depend on Foo 1.0.0. But, how can I stop existing crates from (silently) continuing to use the dangerously-non-secure Foo 1.0.0? I would like to be able to “yank” in such a way that, at a minimum, downstream users are warned during the build of the potential problem. ---
**Author:** ![killercup](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/killercup/32/3256_2.png) [@killercup](https://internals.rust-lang.org/u/killercup)\ **Post date:** [October 29, 2015, 8:26am UTC](https://internals.rust-lang.org/t/handling-end-of-life-of-a-version/2848/2 "2015-10-29T08:26:55Z")
IIRC, npm does it this way: You publish Foo 1.0.1 which adds a deprecation warning on install/build. I’m not sure Cargo allows packages to print warnings, though. (Maybe printing to stderr in a `build.rs`?) ---
**Author:** ![seanmonstar](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/seanmonstar/32/36_2.png) [@seanmonstar](https://internals.rust-lang.org/u/seanmonstar)\ **Post date:** [October 29, 2015, 4:52pm UTC](https://internals.rust-lang.org/t/handling-end-of-life-of-a-version/2848/3 "2015-10-29T16:52:53Z")
Actually, npm allows you to do `npm deprecate Foo@1.0.0 "message"`, which will output a warning with the text from `message` when that version is installed. ---
**Author:** ![sfackler](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/sfackler/32/9_2.png) [@sfackler](https://internals.rust-lang.org/u/sfackler)\ **Post date:** [October 29, 2015, 5:08pm UTC](https://internals.rust-lang.org/t/handling-end-of-life-of-a-version/2848/4 "2015-10-29T17:08:11Z")
I believe Cargo will warn if you depend on a yanked version of a crate. ---
**Author:** ![DenisKolodin](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/deniskolodin/32/1251_2.png) [@DenisKolodin](https://internals.rust-lang.org/u/DenisKolodin)\ **Post date:** [October 29, 2015, 10:09pm UTC](https://internals.rust-lang.org/t/handling-end-of-life-of-a-version/2848/5 "2015-10-29T22:09:48Z")
> [@briansmith](#): > > [crates.io](http://crates.io) supports "yanking" a package, which handles the case for new crates that try to depend on Foo 1.0.0. But, how can I stop existing crates from (silently) continuing to use the dangerously-non-secure Foo 1.0.0? I would like to be able to "yank" in such a way that, at a minimum, downstream users are warned during the build of the potential problem. Cargo discards yanked dependency on update. But I think your case is a problem who uses your library. If you made a mistake yank it and put update. Even some important libs do it. It's great that library still exists: for developers it means **possibility to make changes for future version.** If you drop library completely somebody will lose chance to build own project. ---
**Author:** ![system](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/system/32/14092_2.png) [@system](https://internals.rust-lang.org/u/system)\ **Post date:** [March 25, 2019, 8:25am UTC](https://internals.rust-lang.org/t/handling-end-of-life-of-a-version/2848/6 "2019-03-25T08:25:24Z")
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.