packslip: @ was withdrawn by the vendor

Error message

packslip:{project}@{version} was withdrawn by the vendor{}

What it means

The vendor's signed release list marks the requested version as withdrawn (yanked). This is treated as final: no transparency-log stamp, mirror, or cached manifest can reinstate the version. The message appends the vendor's status_reason when provided.

Solutions

Choose a different (non-withdrawn) version of the tool in mise.toml.
Update the project's mise.lock / tool version to the next safe release the vendor published.
Check the vendor's status_reason in the error for guidance (e.g. CVE advisories) before picking a replacement.
If the withdrawal was a vendor mistake, contact the vendor to republish a fixed release.

Example fix

// before
[tools]
"packslip:foo" = "1.2.3"

// after
[tools]
"packslip:foo" = "1.2.4"

Defensive patterns

Strategy: fallback

Validate before calling

// Before resolving a pinned version, check the vendor list for withdrawal.
if (list.releases[version]?.status === 'withdrawn') {
  console.warn(`${version} is withdrawn; choose a replacement`);
}

Try / catch

try {
  await miseInstall(tool, { version: lockedVersion });
} catch (e) {
  if (String(e).includes('withdrawn by the vendor')) {
    await bumpLockedVersion(tool); // move to next non-withdrawn release
  } else throw e;
}

Prevention

Read status_reason in the error before choosing a replacement — withdrawals often indicate security issues.
Run lockfile refreshes in CI so withdrawals surface as planned upgrades, not surprise failures.
Subscribe to the vendor's security advisories for tools in your lockfiles.
Never try to bypass a withdrawal via mirrors or cached manifests; mise enforces it everywhere.

When it happens

Trigger: vendor_entry calling refuse_if_withdrawn when ReleaseRef::is_yanked() is true for the requested packslip:project@version.

Common situations: A release was pulled for a security vulnerability or bad build; a mise.lock references a version that was later withdrawn; re-installing from a lockfile after the vendor yanked a release.

Related errors

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/0d9dc618bb37553a. Report an issue: GitHub.

Appendix: source

Thrown at src/backend/packslip.rs:667

        return Ok(());
    };
    let (time, source) = match logged_at {
        Some(time) => (time, "transparency log"),
        None => (published_at, "unlogged manifest"),
    };
    if !verified_age_allowed(logged_at, published_at, Some(before))? {
        bail!(
            "packslip release was recorded by the {source} at {time}, after the allowed cutoff {before}; refusing to bypass minimum_release_age"
        );
    }
    Ok(())
}

/// A withdrawal in the vendor's signed list is the end of the matter: no
/// stamp, mirror, or cached manifest reinstates the version.
fn refuse_if_withdrawn(project: &str, version: &str, entry: &ReleaseRef) -> Result<()> {
    if entry.is_yanked() {
        bail!(
            "packslip:{project}@{version} was withdrawn by the vendor{}",
            entry
                .status_reason
                .as_deref()
                .map(|r| format!(": {r}"))
                .unwrap_or_default()
        );
    }
    Ok(())
}

fn verified_age_allowed(
    logged_at: Option<&str>,
    published_at: &str,
    before: Option<jiff::Timestamp>,
) -> Result<bool> {
    let Some(before) = before else {
        return Ok(true);

View on GitHub (pinned to 533346cc37)