{"record":{"id":"0d9dc618bb37553a","repo":"jdx/mise","slug":"packslip-project-version-was-withdrawn-by-the","errorCode":null,"errorMessage":"packslip:{project}@{version} was withdrawn by the vendor{}","messagePattern":"packslip:(.+?)@(.+?) was withdrawn by the vendor(.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/backend/packslip.rs","lineNumber":553,"sourceCode":"        return Ok(());\n    };\n    let (time, source) = match logged_at {\n        Some(time) => (time, \"transparency log\"),\n        None => (published_at, \"unlogged manifest\"),\n    };\n    if !verified_age_allowed(logged_at, published_at, Some(before))? {\n        bail!(\n            \"packslip release was recorded by the {source} at {time}, after the allowed cutoff {before}; refusing to bypass minimum_release_age\"\n        );\n    }\n    Ok(())\n}\n\n/// A withdrawal in the vendor's signed list is the end of the matter: no\n/// stamp, mirror, or cached manifest reinstates the version.\nfn refuse_if_withdrawn(project: &str, version: &str, entry: &ReleaseRef) -> Result<()> {\n    if entry.is_yanked() {\n        bail!(\n            \"packslip:{project}@{version} was withdrawn by the vendor{}\",\n            entry\n                .status_reason\n                .as_deref()\n                .map(|r| format!(\": {r}\"))\n                .unwrap_or_default()\n        );\n    }\n    Ok(())\n}\n\nfn verified_age_allowed(\n    logged_at: Option<&str>,\n    published_at: &str,\n    before: Option<jiff::Timestamp>,\n) -> Result<bool> {\n    let Some(before) = before else {\n        return Ok(true);","sourceCodeStart":535,"sourceCodeEnd":571,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/backend/packslip.rs#L535-L571","documentation":"A withdrawal entry in the vendor's signed release list is treated as final: if `entry.is_yanked()` is true, mise refuses to install that version regardless of stamps, mirrors, or cached manifests. The message optionally appends the vendor's `status_reason` explaining the withdrawal.","triggerScenarios":"Calling `vendor_entry` (via `locate_bundle`, `candidate_exclusion`, or `install_payload`) when the release-list entry for the requested version has a yanked/withdrawn status.","commonSituations":"A vendor withdrew a release due to a vulnerability or bad artifact and a user (or a lockfile/CI pin) still requests that exact version; an old mise.lock references a version that has since been withdrawn.","solutions":["Upgrade to a non-withdrawn version of the tool","Update the pinned version in mise.lock / mise.toml / CI config away from the withdrawn release","Check the vendor's status_reason (shown in the message) and their advisories for guidance"],"exampleFix":"// before (mise.toml)\n[tools.\"packslip:acme\"]\nversion = \"1.2.3\" // withdrawn\n// after\n[tools.\"packslip:acme\"]\nversion = \"1.2.4\"","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  mise::install(\"packslip:acme@1.2.3\")?;\n} catch (e) {\n  if (String(e).includes(\"withdrawn by the vendor\")) {\n    console.error(\"Pick another version; withdrawal is final.\");\n  } else { throw e; }\n}","preventionTips":["Avoid pinning exact versions that could be withdrawn; prefer ranges or newer pins","Subscribe to vendor advisories for withdrawal announcements","Re-resolve lockfiles periodically (`mise upgrade`) instead of keeping stale pins"],"tags":["packslip","withdrawn","supply-chain"],"backgroundTag":"resource-not-found","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}