CARGO-YANK(1)

📦 version 1.83.0, in ubuntu jammy, ubuntu noble

💅 CARGO-YANK(1) — bestie's guide to the cargo yank command

okay so this is from the General Commands Manual section of your man pages, and it's literally about yanking crates out of the index. buckle up 🎀

✨ NAME ✨

cargo-yank — take a pushed crate back out of the index, no cap

🌸 SYNOPSIS 🌸

cargo yank [options] crate@version
cargo yank [options] --version version [crate]

🦋 DESCRIPTION 🦋

so the yank command removes a version of a crate you already published from the server's index. and listen — it does not delete any data, and the crate is still gonna be downloadable via the registry's download link. it's giving "soft hide", not "gone forever" 💀

Cargo won't use a yanked version for any new project or checkout that doesn't already have a lockfile, and it will throw an error if there are no longer any compatible versions left for your crate. awkward.

this command needs you to be authenticated, either with the --token option or by using cargo-login(1).

if you don't specify the crate name, it'll just use the package name from the current directory. convenient ✨

🧚 How yank works

okay imagine the foo crate published version 1.5.0, and another crate bar declared a dependency on version foo = "1.5". now foo drops a new version 2.0.0 — but it's not semver compatible — and then finds a critical issue with 1.5.0. if 1.5.0 gets yanked, no new project or checkout without an existing lockfile will be able to use crate bar, because bar relies on 1.5. 😭

in that case, the maintainers of foo should first publish a semver compatible version like 1.5.1 before yanking 1.5.0, so that bar and every project depending on bar keeps working. please, for the love of everything 🫶

another example: consider a crate bar with published versions 1.5.0, 1.5.1, 1.5.2, 2.0.0 and 3.0.0. the following shows which versions cargo could use in the absence of a lockfile for different SemVer requirements, following a given release being yanked:

if 1.5.0 gets yanked:

  • with bar = "1.5.0" → Use either 1.5.1 or 1.5.2
  • with bar = "=1.5.0" → Return Error
  • with bar = "2.0.0" → Use 2.0.0

if 1.5.1 gets yanked:

  • with bar = "1.5.0" → Use either 1.5.0 or 1.5.2
  • with bar = "=1.5.0" → Use 1.5.0
  • with bar = "2.0.0" → Use 2.0.0

if 2.0.0 gets yanked:

  • with bar = "1.5.0" → Use either 1.5.0, 1.5.1 or 1.5.2
  • with bar = "=1.5.0" → Use 1.5.0
  • with bar = "2.0.0" → Return Error

👑 When to yank

crates should only be yanked in exceptional circumstances, like an accidental publish, an unintentional SemVer breakage, or a significantly broken and unusable crate. that's it. that's the list.

in the case of security vulnerabilities, [RustSec](https://rustsec.org/) is typically a less disruptive mechanism to inform users and encourage them to upgrade — and it avoids the possibility of significant downstream disruption irrespective of susceptibility to the vulnerability in question. lowkey the better move tbh.

a common workflow is to yank a crate having already published a semver compatible version, to reduce the probability of preventing dependent crates from compiling. yes bestie, publish the fix first, yank after. the way that ordering matters 💅

when you're dealing with copyright, licensing, or personal data issues on a published crate, simply yanking it may not suffice. in those cases, contact the maintainers of the registry you used. for crates.io, refer to their [policies](https://crates.io/policies) and contact them at <help@crates.io>.

if credentials have been leaked, the recommended course of action is to revoke them immediately. once a crate has been published, it is impossible to determine if the leaked credentials have been copied. yanking the crate only prevents new users from downloading it, but it cannot stop those who have already downloaded it from keeping or even spreading the leaked credentials. 🚨 yeah. that one's serious.

💖 OPTIONS 💖

🍓 Yank Options

  • --vers version, --version version — the version to yank or un-yank.
  • --undo — undo a yank, putting a version back into the index. rewind time ✨
  • --token token — API token to use when authenticating. this overrides the token stored in the credentials file (which is created by cargo-login(1)).

[Cargo config](https://doc.rust-lang.org/cargo/reference/config.html) environment variables can be used to override the tokens stored in the credentials file. the token for crates.io may be specified with the CARGO_REGISTRY_TOKEN environment variable. tokens for other registries may be specified with environment variables of the form CARGO_REGISTRIES_NAME_TOKEN where NAME is the name of the registry in all capital letters.

  • --index index — the URL of the registry index to use.
  • --registry registry — name of the registry to use. registry names are defined in [Cargo config files](https://doc.rust-lang.org/cargo/reference/config.html). if not specified, the default registry is used, which is defined by the registry.default config key which defaults to crates-io.

🌈 Display Options

  • -v, --verbose — use verbose output. may be specified twice for "very verbose" output which includes extra output such as dependency warnings and build script output. may also be specified with the [term.verbose config value](https://doc.rust-lang.org/cargo/reference/config.html).
  • -q, --quiet — do not print cargo log messages. may also be specified with the [term.quiet config value](https://doc.rust-lang.org/cargo/reference/config.html).
  • --color when — control when colored output is used. valid values:
    • auto (default): automatically detect if color support is available on the terminal.
    • always: always display colors.
    • never: never display colors.

may also be specified with the [term.color config value](https://doc.rust-lang.org/cargo/reference/config.html).

⭐ Common Options

  • +toolchain — if Cargo has been installed with rustup, and the first argument to cargo begins with +, it will be interpreted as a rustup toolchain name (such as +stable or +nightly). see the [rustup documentation](https://rust-lang.github.io/rustup/overrides.html) for more information about how toolchain overrides work.
  • --config KEY=VALUE or PATH — overrides a Cargo configuration value. the argument should be in TOML syntax of KEY=VALUE, or provided as a path to an extra configuration file. this flag may be specified multiple times. see the [command-line overrides section](https://doc.rust-lang.org/cargo/reference/config.html#command-line-overrides) for more information.
  • -C PATH — changes the current working directory before executing any specified operations. this affects things like where cargo looks by default for the project manifest (Cargo.toml), as well as the directories searched for discovering .cargo/config.toml, for example. this option must appear before the command name, for example cargo -C path/to/my-project build.
this option is only available on the [nightly channel](https://doc.rust-lang.org/book/appendix-07-nightly-rust.html) and requires the -Z unstable-options flag to enable (see [#10098](https://github.com/rust-lang/cargo/issues/10098)).
  • -h, --help — prints help information.
  • -Z flag — unstable (nightly-only) flags to Cargo. run cargo -Z help for details.

🌱 ENVIRONMENT 🌱

see the [reference](https://doc.rust-lang.org/cargo/reference/environment-variables.html) for details on environment variables that Cargo reads. iykyk 👀

💀 EXIT STATUS 💀

  • 0: Cargo succeeded. slay 🎉
  • 101: Cargo failed to complete. it's giving pain 😭

🎀 EXAMPLES 🎀

  1. Yank a crate from the index:
cargo yank foo@1.0.7

🫶 SEE ALSO 🫶

cargo(1), cargo-login(1), cargo-publish(1)

and that's the whole page bestie, CARGO-YANK(1) out 💖 go yank responsibly, publish your semver-compatible fix first, and never leak your tokens. mwah 🧚✨

📦 where this page comes from