[cdirkx]

Yes, they are immutable. It's only possible to "yank" a specific version, which will prevent new dependencies, but it will still be available for download for existing dependencies.

https://doc.rust-lang.org/cargo/commands/cargo-yank.html

[dwattttt]

To elaborate on "prevent new dependencies", dependency resolution will never choose a yanked version. However the yanked version remains hosted.