Notify Crate Owners when dependencies get yanked

[WalterSmuts]

Currently when one of the dependencies of a crate gets yanked with no alternate version available it will result in users without a Cargo.lock to experience the following error:

error: failed to select a version for the requirement

The owner of the crate does not get any notification if this has happened, even though this means their crate is un-usable by new users.

My suggestion is to notify crate owners when a version of their crate is no-longer usable because of a "yank"-event. It's then up to the owner of the crate to resolve the issue.

[carols10cents]

Let's say crate B is a library crate that depends on crate A = 1.0. What happens if crate A finds there's a problem with version 1.0.0, yanks it immediately, makes a fix, then in a few hours releases version 1.0.1? For a few hours, people who don't have an existing lock file with crate A 1.0.0 in it who start depending on crate B will get an error about failing to select a version, but once crate A version 1.0.1 is released, everything will be fine-- should crate B be notified for the situation?

[WalterSmuts]

Mmmm. I get the concern of having an overly verbose notification system. We could add logic to only notify the consuming crate owner if it fails dependency resolution for a prolonged time. Say a day or so.

I still personally feel this is a situation where the failing crate owner should be notified anyway. Perhaps have another notification for when it is fixed again so no unnecessary effort is spent if they only respond after it's been fixed. For those few hours the crate is broken for new users and I, as a crate owner, would like to know.

If the dependent crate can be fixed in a couple of hours I would argue it's best to first publish the fix and then yank the crate. Then there would be no down-time for dependent crates. It definitely depends on the severity of the bug but I suspect a huge class of bugs are only issues in rare edge-cases. If the consuming library's tests didn't catch it it's likely that the consuming library is not using the crate in a way that would trigger the bug.

Sure, the above is not really up to the crate owner that received the notification, but dependent crate owners can communicate with the consumed crate owner and inform them of the impact and possible alternatives that could've caused less impact.

[WalterSmuts]

Come to think of it, I think it's also a good idea to present the yanking user with a prompt if the yank would cause dependent crates to fail. This way the yanking user will know exactly what impact their yank will cause. If the bug is severe enough, or if there is little to no impact then the user can continue, but if they were unaware of the dependencies they will be breaking, then this prompt will give them a way out.

Will start another discussion for this idea.

[WalterSmuts]

Started a new discussion here #5266