Enhancing npm unpublish: Allowing maintainers to unpublish specific package versions based on different circumstances

[aryamohanan]

Currently, npm does not provide package maintainers with the ability to unpublish a specific version of a package if the package is not meeting the following criteria:

• no other packages in the npm Public Registry depend on it
• it had less than 300 downloads over the last week
• it has a single owner/maintainer

see current unpublish policy: https://docs.npmjs.com/policies/unpublish

This limitation presents challenges when a version has been mistakenly published. More control over individual versions would help maintain cleaner, more accurate package registries, reduce confusion among users, and allow maintainers to better manage their packages without affecting the entire package.

For example, in our case, version 5.0.0 of a package was mistakenly published instead of version 4. Although the package as a whole has a few dependents, version 5.0.0 itself has only two downloads (from us) and has no active dependents. However, due to npm's current limitations, we are unable to unpublish 5.0.0, because any other version of the package has dependents. But that is completely unrelated to 5.0.0.

I encountered this limitation firsthand when I attempted to unpublish with the command npm unpublish package@versionand received the following error:

You can no longer unpublish this package.
npm ERR! Failed criteria:
npm ERR! has dependent packages in the registry

Currently, npm restricts maintainers from unpublishing specific versions of a package if the package has dependents. The only options available are to unpublish the entire package or remove versions with no dependents and minimal downloads. This restriction forces maintainers to keep incorrectly published versions that contribute to clutter and complicate package management.

Allowing maintainers to unpublish a specific version, even though other versions of the packages have dependents , under the following conditions would offer a practical solution:

• The version has a low number of downloads, based on npm’s current metrics.
• The version itself has no active dependents.
• Could have a time restriction( within 24 hours or so).

reference: npm/rfcs#805
support ticket: 3062638
current unpublish policy: https://docs.npmjs.com/policies/unpublish

[monishcm]

This is a long-term goal but on a short term we do not have a solution. This will go to our backlog and will post you when we pick up. Thanks for the feedback.

[aryamohanan]

Thank you for the update. I understand this is a long-term goal, and I would appreciate it if you could prioritize it. We will wait for your updates. Thanks again for considering the feedback!

[sharadraju]

We are also facing a similar situation, where unpublishing a specific version of our package is a high priority for us. However, we are not able to do so, because of the current unpublish policy .
There are cases, when we may need to simply republish a package version, because of unintended files that may have crept into the package. In this case, it will help a lot if you could atleast provide a way to republish packages with same version number.
Request you to prioritize this.

[ljharb]

Reusing a version number should never be permitted, as the changed integrity values could break people.

[sharadraju]

Thanks @ljharb. Then it would be helpful for us to atleast allow the ability to remove a specific package version from npm.
We can atleast reupload with a new version number.
Even if it requires justification to the npm maintainers and a different process, I am all for it.