why were prior versions yanked?

[cgwalters]

We had code that is building fine with hyper 0.14 and hyper-staticfile 0.6. It seems the prior versions were yanked - why?

[stephank]

Because of RUSTSEC-2022-0069.

I believe yanking should not affect locked dependencies in Cargo.lock? Alternatively, is upgrading to 0.9.2 an obstacle?

[stephank]

It looks like you managed to upgrade it in ostree, that's great! Sorry it was such an unexpected breakage.

It appears I can't really specify a reason when yanking a package. The releases page is what I've been using to communicate things, but maybe that's not the most obvious place. If you have a suggestion, I'd love to hear. Is there a place you'd look first to find a reason?

[cgwalters]

Yes, I think if there was a hit for the word "yank" on the releases page that would have helped.

Anyways, yes we can close this. Thanks!