From 8ee87af975ccd05923e0db428f12e4e0174a9910 Mon Sep 17 00:00:00 2001 From: Thomas Schmelzer Date: Sun, 23 Aug 2026 15:22:44 +0400 Subject: [PATCH] docs: record that 0.2.1 was yanked, and what a yank does not do PROVENANCE.md said "0.2.1 remains on PyPI and still carries it", which was written before the release was yanked and now reads as though nothing was done about it. That is the one document in the repo whose entire purpose is to be an accurate contemporaneous record, so a stale sentence there costs more than it would anywhere else. Verified against PyPI rather than from memory: both files of 0.2.1 are yanked, with `GPL-derived test` as the stated reason, and no later release is. The replacement keeps the distinction that actually matters instead of claiming more than was done. A yank stops every resolver from selecting the version; it is not deletion, and `cvx-quadprog==0.2.1` still installs. Anyone auditing that specific artefact needs to know both halves of that. Co-Authored-By: Claude Opus 5 (1M context) --- PROVENANCE.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/PROVENANCE.md b/PROVENANCE.md index dbc952b..b70ca62 100644 --- a/PROVENANCE.md +++ b/PROVENANCE.md @@ -65,8 +65,13 @@ change, and is absent from **0.2.2** onward. Verified against the published artefact rather than the working tree: `cvx_quadprog-0.2.2.tar.gz` contains 16 files -- the three source modules, four test files, `pytest.ini`, `LICENSE`, `PROVENANCE.md`, `README.md`, `CHANGELOG.md`, `pyproject.toml`, `.gitignore` and -`PKG-INFO` -- and no `test_reference.py`. 0.2.1 remains on PyPI and still carries -it; anyone auditing that specific artefact should know what they are looking at. +`PKG-INFO` -- and no `test_reference.py`. + +0.2.1 has since been **yanked**, with `GPL-derived test` as the stated reason, so +no resolver will select it. Yanking is not deletion, and the distinction is the +point of recording it here: the artefact is still on PyPI and an exact pin +(`cvx-quadprog==0.2.1`) still installs it, so anyone auditing that specific file +should know what is in it. ## The GPL dependency