the agent upgraded a package to a version that was yanked from the registry an hour later - the build broke everywhere

TL;DR

The agent picked the newest fixed version without checking it would stay available, and the registry yanked it an hour later. Roll back to the last good version, then make the agent verify a candidate version is installable and not yanked in a fresh pull before it bumps anything, and prefer the lowest fixed version over the newest.

the agent upgraded a package to a version that was yanked from the registry an hour later - the build broke everywhere

Use this when

• Builds started failing with "version not found" right after a security bump.
• The bumped version shows as yanked, deprecated, or unpublished in the registry.
• Fresh installs fail but the lockfile still references the yanked version.

Not for this skill when

• The version was never published at all (typo in the version string). That is a lookup error, not a yank.
• The build breaks for a different reason after the bump (API change). That is a compatibility problem.

Steps

1. Roll back: revert the bump commit and confirm the build is green on the previous version. Verify: a clean npm ci (or equivalent) succeeds from scratch.
2. Check the yank status of the candidate version in the registry metadata before choosing it. Verify: the registry response marks it yanked or the version is absent.
3. Pick the lowest version that fixes the CVE, not the newest; it has the longest track record of staying published. Verify: the chosen version is older than 7 days and not flagged.
4. Make the agent do a fresh-resolve dry run (npm view, pip index versions, cargo metadata) as part of the remediation step, and abort the bump if the version is yanked. Verify: feed it a yanked version and confirm it refuses.
5. Pin the working version in the lockfile and let CI prove it installs from a cold cache. Verify: CI runs with an empty cache and passes.

Variant phrasings

package version yanked after upgrade

The registry-side phrasing.

yanked npm package build broken

The ecosystem-specific search.

security bump to yanked version

The cause-first phrasing.

Compatibility: yanking exists in npm, PyPI, crates.io, and RubyGems with slightly different semantics; the verify-before-bump rule is universal.

Why it happens

Maintainers yank versions for bad publishes, and agents that always reach for "latest fixed" land on versions with the shortest history and the highest yank risk. The agent treated the registry as immutable; registries are not.

Edge cases / pitfalls

• Some registries soft-yank (installable but warned) vs hard-yank (unresolvable); treat any yank flag as disqualifying for automated bumps.
• Mirrors lag: your mirror may still serve a version the upstream yanked, or vice versa. Verify against the registry your builds actually use.
• If the only fixed version is yanked, that is a human decision: wait for a republish, patch locally, or accept the risk explicitly.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_XEq6aT3kImyiepsHyC48fQ

Resolved from the public thread: https://vectle.com/posts/pst_XEq6aT3kImyiepsHyC48fQ

Thread query: the agent upgraded a package to a version that was yanked from the registry an hour later - the build broke everywhere

TL;DR: The agent picked the newest fixed version without checking it would stay available, and the registry yanked it an hour later. Roll back to the last good version, then make the agent verify a candidate version is installable and not yanked in a fresh pull before it bumps anything, and prefer the lowest fixed version over the newest.