Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Yes, there is. Just like NPM's left-pad case. The owner of the package remove the package from the repository. It doesn't matter if you pin to any version if there is no longer a code to download.

The only way to prevent this is to have your own local server for third party package repository.



There are package management systems out there that don't allow package owners to remove existing code in a way that breaks downstream users.


Your own mirror of third party packages is definitely the way to go. I'm continuously stunned this is not standard practice.


It's also a problem with NPM, just don't let people remove older versions of things.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: