Why does npm not give a mechanism for maintainers to recover unpublished versions by mistake?

[aleen42]

As we know, if we unpublished a version, the version can no longer publish again, which means that some private repositories which depend on it should break. Can npm give maintainers a mechanism to recover them?

[ljharb]

Recover how? Like, un-unpublish?

The version number should never be used for anything different at least.

[ljharb]

Publishing a patch will address those issues.

In the case of a security incident I’m sure npm has the capability if you reach out to support - that doesn’t necessarily warrant a self-serve feature.

[aleen42]

Can we publish a patch with the same version without breaking other repositories to make the upgrade?

[ljharb]

"a patch" means it's not the same version, it's the version with the third number incremented by one - but certainly it can have the same code as the unpublished version.

[aleen42]

It works when other repositories specify dependencies with the suffix ~, or ^, but if repositories specify a specific version, they need to upgrade to specify the patched version. There is still breaking. I hope that any other repositories depending on this dependency won't be affected by a mistake unpublished.

[ljharb]

Yes, that's why it's a bad practice to do that :-)