Can 0.2.1.post1 be yanked?

[konstin]

With tools that perform universal resolution instead of platform-specific resolution, such as uv, tools pick up 0.2.1.post1 instead of 0.2.1 for a >=0.2, <0.3 pin (or poetry's ^0.2) and then fail to install on most machines.

While this release is old and it has been fixed on newer versions, there are still a number of projects that depend on 0.2.x, which makes this problem show up here (#292) and regularly in the uv bug tracker (https://github.com/astral-sh/uv/issues?q=is%3Aissue%20kaleido). Would it be possible to yank 0.2.1.post1 to prevent this user confusion?

[gvwilson]

cc @ayjayt - what do you think?

[ayjayt]

@gvwilson

Was kind of hoping resolvers would value backwards compatibility here, that said:

1. v0.2.1.post1 and v0.2.0 are equal but support different systems
2. Modern resolvers don't traverse down if they don't find their system, they just error
3. Users are choosing convenience over security and still installing v0 (tough problem to solve)
4. I think we could download and bundle all latest v0.2.* for all systems as v0.2.3 to not inconvenience these users, but we're also deprecating v0 AFAIK, we maybe add a deprecation notice? Thoughts @emilykl?

Thanks @konstin !