docs: record that 0.2.1 was yanked, and what a yank does not do - #113
Open
tschm wants to merge 2 commits into
Open
docs: record that 0.2.1 was yanked, and what a yank does not do#113tschm wants to merge 2 commits into
tschm wants to merge 2 commits into
Conversation
PROVENANCE.md said "0.2.1 remains on PyPI and still carries it", which was written before the release was yanked and now reads as though nothing was done about it. That is the one document in the repo whose entire purpose is to be an accurate contemporaneous record, so a stale sentence there costs more than it would anywhere else. Verified against PyPI rather than from memory: both files of 0.2.1 are yanked, with `GPL-derived test` as the stated reason, and no later release is. The replacement keeps the distinction that actually matters instead of claiming more than was done. A yank stops every resolver from selecting the version; it is not deletion, and `cvx-quadprog==0.2.1` still installs. Anyone auditing that specific artefact needs to know both halves of that. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Updates PROVENANCE.md to accurately reflect the current PyPI status of release 0.2.1 (now yanked), and clarifies what yanking does and does not imply for auditors reviewing historical artifacts.
Changes:
- Replaces stale wording about 0.2.1 “remaining on PyPI” with an explicit record that it was yanked and why.
- Clarifies that yanking affects default resolver selection but does not delete the artifact or prevent exact pins from installing it.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+70
to
+72
| 0.2.1 has since been **yanked**, with `GPL-derived test` as the stated reason, so | ||
| no resolver will select it. Yanking is not deletion, and the distinction is the | ||
| point of recording it here: the artefact is still on PyPI and an exact pin |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PROVENANCE.mdsaid:That was written before the release was yanked, and now reads as though nothing
was done about it. It is the one document in the repo whose entire purpose is to
be an accurate contemporaneous record, so a stale sentence costs more there than
it would anywhere else — and it is the page you would point an outside auditor at.
Verified against PyPI rather than from memory:
The replacement records the yank and its reason, and keeps the distinction that
matters rather than claiming more than was done: a yank stops every resolver from
selecting the version, but it is not deletion, and
cvx-quadprog==0.2.1stillinstalls. An auditor needs both halves of that.
Documentation only — no source, no tests, no published figures touched.
🤖 Generated with Claude Code