Enhancing npm unpublish: Allowing maintainers to unpublish specific package versions based on different circumstances

[aryamohanan]

Currently, npm does not provide package maintainers with the ability to unpublish a specific version of a package if the package is not meeting the following criteria:

• no other packages in the npm Public Registry depend on it
• it had less than 300 downloads over the last week
• it has a single owner/maintainer

see current unpublish policy: https://docs.npmjs.com/policies/unpublish

This limitation presents challenges when a version has been mistakenly published. More control over individual versions would help maintain cleaner, more accurate package registries, reduce confusion among users, and allow maintainers to better manage their packages without affecting the entire package.

For example, in our case, version 5.0.0 of a package was mistakenly published instead of version 4. Although the package as a whole has a few dependents, version 5.0.0 itself has only two downloads (from us) and has no active dependents. However, due to npm's current limitations, we are unable to unpublish 5.0.0, because any other version of the package has dependents. But that is completely unrelated to 5.0.0.

I encountered this limitation firsthand when I attempted to unpublish with the command npm unpublish package@versionand received the following error:

You can no longer unpublish this package.
npm ERR! Failed criteria:
npm ERR! has dependent packages in the registry

Currently, npm restricts maintainers from unpublishing specific versions of a package if the package has dependents. The only options available are to unpublish the entire package or remove versions with no dependents and minimal downloads. This restriction forces maintainers to keep incorrectly published versions that contribute to clutter and complicate package management.

Allowing maintainers to unpublish a specific version, even though other versions of the packages have dependents , under the following conditions would offer a practical solution:

• The version has a low number of downloads, based on npm’s current metrics.
• The version itself has no active dependents.
• Could have a time restriction( within 24 hours or so).

reference: npm/rfcs#805
support ticket: 3062638
current unpublish policy: https://docs.npmjs.com/policies/unpublish

[monishcm]

This is a long-term goal but on a short term we do not have a solution. This will go to our backlog and will post you when we pick up. Thanks for the feedback.

[aryamohanan]

Thank you for the update. I understand this is a long-term goal, and I would appreciate it if you could prioritize it. We will wait for your updates. Thanks again for considering the feedback!