jdx/mise · error

packslip:{project}@{version} was withdrawn by the vendor{}

Error message

packslip:{project}@{version} was withdrawn by the vendor{}

What it means

A withdrawal entry in the vendor's signed release list is treated as final: if `entry.is_yanked()` is true, mise refuses to install that version regardless of stamps, mirrors, or cached manifests. The message optionally appends the vendor's `status_reason` explaining the withdrawal.

Source

Thrown at src/backend/packslip.rs:553

        return Ok(());
    };
    let (time, source) = match logged_at {
        Some(time) => (time, "transparency log"),
        None => (published_at, "unlogged manifest"),
    };
    if !verified_age_allowed(logged_at, published_at, Some(before))? {
        bail!(
            "packslip release was recorded by the {source} at {time}, after the allowed cutoff {before}; refusing to bypass minimum_release_age"
        );
    }
    Ok(())
}

/// A withdrawal in the vendor's signed list is the end of the matter: no
/// stamp, mirror, or cached manifest reinstates the version.
fn refuse_if_withdrawn(project: &str, version: &str, entry: &ReleaseRef) -> Result<()> {
    if entry.is_yanked() {
        bail!(
            "packslip:{project}@{version} was withdrawn by the vendor{}",
            entry
                .status_reason
                .as_deref()
                .map(|r| format!(": {r}"))
                .unwrap_or_default()
        );
    }
    Ok(())
}

fn verified_age_allowed(
    logged_at: Option<&str>,
    published_at: &str,
    before: Option<jiff::Timestamp>,
) -> Result<bool> {
    let Some(before) = before else {
        return Ok(true);

View on GitHub (pinned to afd2eddd3a)

Solutions

1. Upgrade to a non-withdrawn version of the tool
2. Update the pinned version in mise.lock / mise.toml / CI config away from the withdrawn release
3. Check the vendor's status_reason (shown in the message) and their advisories for guidance

Example fix

// before (mise.toml)
[tools."packslip:acme"]
version = "1.2.3" // withdrawn
// after
[tools."packslip:acme"]
version = "1.2.4"

try {
  mise::install("packslip:acme@1.2.3")?;
} catch (e) {
  if (String(e).includes("withdrawn by the vendor")) {
    console.error("Pick another version; withdrawal is final.");
  } else { throw e; }
}

When it happens

Trigger: Calling `vendor_entry` (via `locate_bundle`, `candidate_exclusion`, or `install_payload`) when the release-list entry for the requested version has a yanked/withdrawn status.

Common situations: A vendor withdrew a release due to a vulnerability or bad artifact and a user (or a lockfile/CI pin) still requests that exact version; an old mise.lock references a version that has since been withdrawn.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• the release list expired at {}; the vendor has not published
• packslip release was recorded by the {source} at {time}, aft
• packslip:{project}: this release {}. If the vendor announce
• must not record a pin before replacement succeeds
• packslip:{tool_name} is not a project name; use github.com/o

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/0d9dc618bb37553a. Report an issue: GitHub.