Aws-sdk-ruby: Unexpected removal of aws-sdk-batch v1.5.0 from rubygems

Created on 12 Jun 2020 · 7Comments · Source: aws/aws-sdk-ruby

Our production stack almost went down today unexpectedly because aws-sdk-batch v1.5.0 was yanked: https://rubygems.org/gems/aws-sdk-batch/versions/1.5.0

Recovering it at the moment, hopefully upgrading the lib quickly to 1.32.1 won't create new issues for us...

Is there some plan where you specify when you're planning to remove some versions from public access?

Thanks

guidance needs-triage

Source

GProst

👍1

Most helpful comment

@mullermp thanks for the explanation, don't be too hard on yourself
We don't rely on 1.5.0 now but having it unyanked probably not the worst idea since I think there is a chance some people could still rely on it

GProst on 12 Jun 2020

👍3

All 7 comments

I see 1.32.0 version was also yanked, have you been hacked?

GProst on 12 Jun 2020

I'm sorry this impacted you! We had an issue with a the release of gems on 6/10 that required us to yank versions of all of the sdk service gems that we published on 6/10 (see: #2327).

We have published corrected versions of those gems today - for aws-sdk-batch you should be able to use 1.32.1.

Apologies again for this! We do not regularly yank gems - we do so only when they contain incorrectly released and breaking changes.

Please feel to reach out or re-open if you run into issues using 1.32.1.

alextwoods on 12 Jun 2020

Thanks for your quick reply. Can I ask for some clarification @alextwoods? We've had version 1.5.0 as a dependency for almost two years. I don't think you're saying that 1.5.0 was (re)published on 6/10, but then I don't understand why 1.5.0 needed to be unpublished if it hasn't changed in two years.

aharbick on 12 Jun 2020

batch-1.5.0 was incorrectly yanked by myself in the heat of things yesterday. We were getting throttled when I tried automating removing the bad gems, so I started yanking manually and I was looking at the wrong line in my list. I am sorry about this. I really wish yesterday didn't exist. I was not able to unyank it because the API from Rubygems has been removed. I can reach out to the rubygems team and have it unyanked.

mullermp on 12 Jun 2020

👍1

Thanks for the transparency @mullermp. Updating was painless (working through several autoscaling deployment configuration issues on our side to get it out was a little... tricky) So I'll go with