{"record":{"id":"0d9dc618bb37553a","repo":"jdx/mise","slug":"packslip-project-version-was-withdrawn-by-the","errorCode":null,"errorMessage":"packslip:{project}@{version} was withdrawn by the vendor{}","messagePattern":"packslip:(.+?)@(.+?) was withdrawn by the vendor(.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/backend/packslip.rs","lineNumber":667,"sourceCode":"        return Ok(());\n    };\n    let (time, source) = match logged_at {\n        Some(time) => (time, \"transparency log\"),\n        None => (published_at, \"unlogged manifest\"),\n    };\n    if !verified_age_allowed(logged_at, published_at, Some(before))? {\n        bail!(\n            \"packslip release was recorded by the {source} at {time}, after the allowed cutoff {before}; refusing to bypass minimum_release_age\"\n        );\n    }\n    Ok(())\n}\n\n/// A withdrawal in the vendor's signed list is the end of the matter: no\n/// stamp, mirror, or cached manifest reinstates the version.\nfn refuse_if_withdrawn(project: &str, version: &str, entry: &ReleaseRef) -> Result<()> {\n    if entry.is_yanked() {\n        bail!(\n            \"packslip:{project}@{version} was withdrawn by the vendor{}\",\n            entry\n                .status_reason\n                .as_deref()\n                .map(|r| format!(\": {r}\"))\n                .unwrap_or_default()\n        );\n    }\n    Ok(())\n}\n\nfn verified_age_allowed(\n    logged_at: Option<&str>,\n    published_at: &str,\n    before: Option<jiff::Timestamp>,\n) -> Result<bool> {\n    let Some(before) = before else {\n        return Ok(true);","sourceCodeStart":649,"sourceCodeEnd":685,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/backend/packslip.rs#L649-L685","documentation":"The vendor's signed release list marks the requested version as withdrawn (yanked). This is treated as final: no transparency-log stamp, mirror, or cached manifest can reinstate the version. The message appends the vendor's status_reason when provided.","triggerScenarios":"vendor_entry calling refuse_if_withdrawn when ReleaseRef::is_yanked() is true for the requested packslip:project@version.","commonSituations":"A release was pulled for a security vulnerability or bad build; a mise.lock references a version that was later withdrawn; re-installing from a lockfile after the vendor yanked a release.","solutions":["Choose a different (non-withdrawn) version of the tool in mise.toml.","Update the project's mise.lock / tool version to the next safe release the vendor published.","Check the vendor's status_reason in the error for guidance (e.g. CVE advisories) before picking a replacement.","If the withdrawal was a vendor mistake, contact the vendor to republish a fixed release."],"exampleFix":"// before\n[tools]\n\"packslip:foo\" = \"1.2.3\"\n\n// after\n[tools]\n\"packslip:foo\" = \"1.2.4\"","handlingStrategy":"fallback","validationCode":"// Before resolving a pinned version, check the vendor list for withdrawal.\nif (list.releases[version]?.status === 'withdrawn') {\n  console.warn(`${version} is withdrawn; choose a replacement`);\n}","typeGuard":null,"tryCatchPattern":"try {\n  await miseInstall(tool, { version: lockedVersion });\n} catch (e) {\n  if (String(e).includes('withdrawn by the vendor')) {\n    await bumpLockedVersion(tool); // move to next non-withdrawn release\n  } else throw e;\n}","preventionTips":["Read status_reason in the error before choosing a replacement — withdrawals often indicate security issues.","Run lockfile refreshes in CI so withdrawals surface as planned upgrades, not surprise failures.","Subscribe to the vendor's security advisories for tools in your lockfiles.","Never try to bypass a withdrawal via mirrors or cached manifests; mise enforces it everywhere."],"tags":["packslip","yanked-release","supply-chain","withdrawn"],"backgroundTag":"version-withdrawn","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}