#molt yank

Check a released version and print the exact steps to yank it on PyPI (PEP 592) -- the recovery path for a bad release that changesets structurally cannot offer.

molt yank does not yank for you. PyPI provides no supported way for a tool to yank a release: it is a web-UI action, there is no API endpoint, and an upload token does not grant it. So molt yank does the part it can do -- verify the version, tell you whether it is already yanked, and hand you the exact URL and steps -- and you complete the yank in your browser. See Why this is a manual step.

#Synopsis

molt yank <package> <version> [OPTIONS]

#Description

PyPI is immutable: a published version cannot be deleted or overwritten. But PEP 592 lets you yank it. A yanked version is still installable by an exact pin that already depends on it, so nothing that already resolved to it breaks -- but resolvers stop selecting it for new installs. It is the correct response to a release that is broken but must remain downloadable for reproducibility.

molt yank is the guided front end to that. It reads the index's public JSON API and reports:

• whether <package> exists and <version> is actually on the index,
• whether that version is already yanked, and the reason recorded on it,
• the release-management URL and the steps to complete the yank, with your --reason text ready to paste.

It contacts only the public read API, so it needs no credentials and changes nothing. Run it before you go clicking -- it catches the typo'd version number that would otherwise have you yanking the wrong release.

#Why this is a manual step

PEP 592 specifies how installers read a yank (the data-yanked attribute in the Simple API). It deliberately leaves it to each index to decide how a maintainer sets one. PyPI implements setting it as a web form on the release-management page only:

• there is no documented API endpoint for yanking, and none is planned on a published schedule (warehouse#12708 tracks the request),
• twine has no yank command,
• PyPI API tokens are scoped to uploads, so the credential your CI already holds could not perform a yank even if an endpoint existed -- project management requires a logged-in session with 2FA,
• only a project Owner may yank; a Maintainer cannot.

Molt will not drive an undocumented HTML form with your account password to paper over that. If PyPI ships a management API, molt yank gains a flag to complete the action itself and this page changes; the surface here is designed so that change is additive.

Third-party indexes (devpi, Artifactory) do expose yank APIs. Support for completing a yank on those is not implemented.

#Options

molt yank takes no --dry-run: it never mutates, so every run is already a dry run. It takes no --yes either -- there is nothing to confirm.

#Exit codes

#Examples

Check a broken patch and get the steps, with the reason ready to paste:

molt yank acme-core 1.1.0 --reason "Corrupt wheel; use 1.1.1."

acme-core 1.1.0 is on pypi.org and is not yanked.

To yank it, PyPI requires you to do this in a browser -- there is no API for it:

  1. Open https://pypi.org/manage/project/acme-core/releases/
  2. Click Options next to 1.1.0, then Yank
  3. Paste this reason: Corrupt wheel; use 1.1.1.
  4. Confirm

You must be an Owner of the project, signed in with 2FA.

Check the steps to un-yank once the record is corrected:

molt yank acme-core 1.1.0 --undo

Check a version on another index:

molt yank acme-core 1.1.0 --repository testpypi

#See also

• Yanking a release -- when and how to yank safely.
• Why Molt? -- why PyPI immutability makes yank matter.
• molt publish.