docs: RELEASE.md described a withdrawal that did not happen - #48
Merged
Conversation
The 1.x section was written between deciding to unpublish the line and finding out npm would not allow it, and it shipped in #44 claiming "1.0.2 through 1.5.0 were published on 25-26 Aug 2026 and unpublished inside npm's 72-hour window." They are all still on the registry. Anyone reading that section would conclude the packument had one version in it and go looking for a bug when it has ten. What actually happened: all nine are deprecated, so they stay installable for anyone pinned and warn on every fresh install, pointing at @latest. That is the outcome the section should have described in the first place — the reasoning it gave for preferring deprecation was already sitting in its own last paragraph. Also records that the unscoped `orcacode-review` deprecation is still undone, which the file has prescribed since the org move without saying it had never been run. It cannot be run from CI: NPM_TOKEN is scoped to this one package, which is exactly the property that makes a leak survivable, so the command needs the personal account that owns the name.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The 1.x section was written between deciding to unpublish the line and finding out npm would not allow it, and it shipped in #44 claiming 1.0.2–1.5.0 "were published on 25–26 Aug 2026 and unpublished inside npm's 72-hour window." They are all still on the registry. Anyone reading it would expect a packument with one version and go hunting for a bug when it has ten.
What actually happened, after #45/#46 established that CI cannot unpublish: all nine are deprecated via #47's workflow. They stay installable for anyone pinned, and every fresh install warns and points at
@latest. Verified against the anonymous packument:That is the outcome the section should have described from the start — the argument for preferring deprecation was already sitting in its own last paragraph.
Also records that the unscoped
orcacode-reviewdeprecation is still undone, which the file has prescribed since the org move without ever saying it had not been run. It can't come from CI:NPM_TOKENis scoped to this one package, which is exactly what makes a leak survivable, so that command needs the personal account holding the name.