cargo-yank

remove a pushed crate version from the registry

TLDR

Yank version from registry

$ cargo yank [[email protected]]

Yank with version flag

$ cargo yank --version [1.0.0] [crate]

Undo yank

$ cargo yank --undo [[email protected]]

Yank from alternate registry

$ cargo yank --registry [my-registry] [[email protected]]

SYNOPSIS

cargo yank [options] crate@versioncargo yank [options] --version version [crate]

cargo yank marks a crate version as yanked on the registry. Yanked versions cannot be used as new dependencies but existing Cargo.lock files continue to work. Does not delete data.Requires authentication via cargo login.

PARAMETERS

--version version

Version to yank

--undo

Restore yanked version

--registry name

Target registry

--index url

Registry index URL

--token token

API token

-h, --help

Print help information

-v, --verbose

Verbose output

-q, --quiet

Suppress output

--color WHEN

Coloring: auto, always, never

BEHAVIOR

Yanked versions- Cannot be added as new dependencies- Existing Cargo.lock references still work- Not deleted from registry

WHEN TO YANK

- Accidental publish- Unintentional semver breakage- Significantly broken functionality- Security issues (consider RustSec instead)

BEST PRACTICE

Publish a fixed version (e.g., 1.5.1) before yanking the broken version (1.5.0).

INSTALL

sudo apt install cargo

sudo dnf install cargo

sudo apk add cargo

sudo zypper install cargo

nix profile install nixpkgs#cargo

CAVEATS

crates.io is a permanent archive; yanking marks version unavailable but doesn't delete. For security issues, RustSec advisories are less disruptive.