[riffraff]

there are a few possible cases of users suffering:

* you push a revision which introduces a bug

* you push a release which introduces involuntary API breakage

* the new release has a glaring security issue

* release X relies on a third party which has changed (think: some web service) and therefore doesn't work anymore

Sure, you can push a newer release but you don't want _anyone_ to be using the old one.

I'm not saying yanking is good, but maybe a notification system "this package should not be used, upgrade to XXX" would be useful.

[serge2k]

Vendor guidance would be great.