[BUG] cannot unpublish 2 minutes after publishing

[ovanderzee]

Current Behavior:

I received an error message at the command line:
$ npm unpublish my-lib@1.4.0
npm ERR! code E405
npm ERR! 405 Method Not Allowed - PUT https://registry.npmjs.org/my-lib/-rev/14-878ad331638f5b05ac5eb9a52ff15fc0 - You can no longer unpublish this package.
npm ERR! Failed criteria:
npm ERR! has dependent packages in the registry
npm ERR!
npm ERR! Please deprecate it instead:
npm ERR! npm deprecate -f 'my-lib@1.4.0' "this package has been deprecated"
npm ERR! To learn more about our unpublish policies, see https://www.npmjs.com/policies/unpublish

npm ERR! A complete log of this run can be found in:
npm ERR!     /Users/ovdz/.npm/_logs/2020-08-18T08_20_02_031Z-debug.log

Expected Behavior:

I expected the package to be unpublished, like described in https://docs.npmjs.com/cli/unpublish
An other page, https://www.npmjs.com/policies/unpublish talks about "newly created packages"
The description of both pages do not match.
Anyhow, i think it should be possible to remove packages with errors within a few minutes.

Steps To Reproduce:

publish in the root directory of a before published package

npm publish

unpublish with package name and version number

npm unpublish before-published-package@1.2.3

Environment:

• OS: MacOS 10.14.6 (Mojave)
• Node: 12.18.0
• NPM: 6.14.4

[styfle]

I had the same error message but I didn't even run npm unpublish.
It happened when running npm publish pkg@1.2.3 followed by npm deprecate pkg@1.2.3.

https://github.com/vercel/vercel/runs/1076007594#step:6:649

My best guess is that there is a consistency problem after publishing a package and immediately running another command. It may or may not be related to the original issue posted here.

[waterplea]

Happened to me too. I know there's one dependent package but it has a fixed version. How come I cannot unpublish a newer version that nobody is dependent on?

[ljharb]

The current policy is unfortunately that if any version is depended on, then no version can be unpublished.

You can try filing a support ticket to see if they can help, but in the meantime, your best bet is to file a patch version that's later than the one you want to unpublish (changing "latest" won't help people who have already upgraded), and then npm deprecate the bad one, and then npm support is more likely (but still not guaranteed) to help you unpublish the bad one.

[waterplea]

Got it. That's sad that any dependent version is a blocker :(

[darcyclarke]

npm v6 is no longer in active development; We will continue to push security releases to v6 at our team's discretion as-per our Support Policy.

If your bug is preproducible on v7, please re-file this issue using our new issue template.

If your issue was a feature request, please consider opening a new RRFC or RFC. If your issue was a question or other idea that was not CLI-specific, consider opening a discussion on our feedback repo

Closing: This is an automated message.

[djipco]

The current policy is unfortunately that if any version is depended on, then no version can be unpublished.

This is quite surprising. I do not think there is a gain in preventing the author to unpublish a new version that nobody depends on. On the other end, I can see several reasons why this may be bad for the community...

[Abhinandan-Kushwaha]

The current policy is unfortunately that if any version is depended on, then no version can be unpublished.

@ljharb This is disheartening. If I accidentally published a new version, can't unpublish it even the very next minute.

Also, the command npm publish doesn't even ask for confirmation. Please consider adding a confirmation dialog to the npm publish command.
Thanks in advance!

[ljharb]

@Abhinandan-Kushwaha if you have 2fa enabled, as you should, then there is a confirmation already.