Maintain, retire and report

Yank a bad version

A yank withdraws a version that has a serious problem, for example a mistake that could cause harm.

1. Open Publish, choose Manage on your package.
2. Under Versions, choose Yank next to the bad version.
3. Enter a reason and choose Yank version.

New installs of that version stop. Existing installs keep working. You cannot undo a yank, and the version number can never be used again. People see the version marked Yanked.

Prefer a new version for a small fix. Yank only when the old one should not be used.

Deprecate a package you are retiring

A package you no longer recommend can be deprecated. It stays installable.

1. On Manage this package find Deprecate.
2. Optionally write a message, for example "replaced by @acme/new-package" (up to 300 characters).
3. Choose Mark as deprecated.

A Deprecated banner now appears on the package page. Use Update deprecation to change the message and Remove deprecation to reverse it.

Keep your listing honest

In Listing details keep the display name, summary, categories and tags accurate. Choose Private visibility to keep a package to your team only. Misleading listings get reported.

Reports

Everyone has a way to flag a problem. On any package, Report this package asks What's the problem? with these choices:

• Harmful or malicious behaviour
• Spam or misleading listing
• Copyright or trademark
• Does not work
• Inappropriate content
• Something else

Add optional Details up to 2,000 characters, then Send report. The PGB team looks at them.

If someone reports your package, check the claim, fix it in a new version, or yank the version if necessary.

Team work

Owners can Add a team member to a publisher. A Maintainer can publish versions and manage packages. An Owner can also add people. Give publishing rights only to people you trust, since a package runs with the permissions it declares in other people's projects.

Your public page

Each publisher has a Public page listing all its packages. A Verified mark means PGB confirmed your identity. Without it, you are shown as a community publisher.

Publish checklist

1. Smallest set of permissions.
2. No secrets, no .env files.
3. A clear summary and README.
4. A realistic first version number and license.
5. Test installs yourself before announcing it.
6. Plan for support: how will you ship fixes?

Try it yourself

1. Open your test package's Manage page and set a deprecation message, then remove it.
2. Find a package you do not own and open Report this package; read the choices without sending.
3. Open My installs and see what a user sees.

Recap

• Yank withdraws a version; Deprecate warns about a whole package.
• Reports cover malware, spam, copyright, broken, inappropriate and other problems.
• Publisher roles: Maintainer and Owner.
• Keep listings accurate and permissions minimal.