Release Incident Playbook

Dependency removed from registry: symptoms, cause, and the test that catches it

A package or version is pulled from a registry and builds or deploys fail.

Dependency removed from registry is documented by 3 accepted public reports from 3 organisations, 1 of them published in the last 5 years.

  • Likelihood: not published (1 public report in 5 years)
  • Impact: medium (3 of 3 reports: availability)

3 public reports · verified 2026-10-22

Symptoms

User-visible

  • Projects that depended on an unpublished string padding package, directly or through dependency chains, failed to install.[3]
  • Install errors continued after a replacement 1.0.0 of the string padding package was published, because a dependency chain explicitly requested version 0.0.3.[3]
  • Installing any version of the Ruby web framework failed.[2]
  • The dependency manager reported that the bundle was locked to version 0.3.5 of a MIME type detection gem, which no source held because the author had removed it.[2]
  • CI pipelines failed across the cluster project, at least on release-1.3.[1]

Monitoring-visible

  • The JavaScript package registry observed hundreds of install failures per minute shortly after 2:30 PM Pacific Time on March 22.[3]
  • A cluster event reported a failed pull of the command-line cluster client image tag 1.30.2 with rpc error NotFound.[1]
  • A framework contributor reported the install failure in the framework's issue tracker on the same day the gem builds were yanked.[2]

Root causes

  1. stage: third-party An author unpublished 273 packages from the JavaScript package registry without warning to dependent projects, and one of them was the string padding package.[3]
  2. stage: third-party The MIME type detection gem's maintainer yanked all builds prior to 0.4.0 to resolve a licensing issue, while the framework's storage component depended on version ~> 0.3.2.[2]
  3. stage: third-party The command-line cluster client image was removed from the public container registry it was pulled from.[1]
  4. stage: config The policy reports cleanup job's image reference had been missed when the project switched its images to a legacy repository.[1]

Public examples

  1. [1]Sylva project, 2025-09-18. After the docker.io/bitnami/kubectl image was removed from Docker Hub, Sylva CI pipelines failed because a Kyverno cleanup job could not pull bitnami/kubectl:1.30.2, an image reference missed when the project switched its images to docker.io/bitnamilegacy. primary failures due to removal of some docker.io/bitnami/... images (in parrticular kyverno w. bitnami/kubectl image)
  2. [2]Rails, 2021-03-24. The mimemagic gem yanked all builds prior to 0.4.0 to resolve a licensing issue, and because Rails activestorage depended on mimemagic ~> 0.3.2, bundles locked to mimemagic 0.3.5 could not install Rails until the maintainer released a compatible 0.3.6. primary Dependency on mimemagic 0.3.x no longer valid
  3. [3]npm, Inc., 2016-03-23. An author unpublished 273 packages from the npm registry, including left-pad, and projects that depended on it directly or through dependency chains such as babel and atom failed to install for about 2.5 hours until npm re-published the original version from a backup. primary kik, left-pad, and npm

Test classes that catch it

Test classStageLimitationBasis
Integration testspre-deployAn integration test that passed before the removal stays green until it reinstalls, because the string padding package, the older gem builds and the cluster client image were each removed after the dependent projects had shipped.by design analysis
Configuration and environment testspre-deployA configuration check that lists image references in deployment values does not see versions pinned inside a dependency chain, such as the string padding package 0.0.3.by design analysis

Risk

  • Likelihood: not published (1 public report in 5 years)
  • Impact: medium (3 of 3 reports: availability)
Counts behind the grades
Accepted public reports3
Published in the last 5 years1
Impact stated: availability3

How the grades are computed

Pre-release checklist

  • PR-01
  • PR-02
  • PR-03
  • PR-04
  • PR-05
  • PR-06

First 30 minutes

  • FM-01
  • FM-02
  • FM-03
  • FM-04
  • FM-05
  • FM-06
  • FM-07

Download the checklist

What catches this: catalogue entries

Listed because their own documentation or site names integration tests, configuration and environment tests on the verification date. Alphabetical. Not a recommendation.

Tools whose documentation names these test classes

Providers whose site names these test classes

Only on this page

Dependency removed from registry starts in the third-party stage in report [1], report [2] and report [3], not in application code. In report [3], an author unpublished 273 packages from the JavaScript package registry without warning to dependent projects [3]. In report [2], a gem maintainer yanked all builds prior to 0.4.0 to resolve a licensing issue [2]. In report [1], a container image was removed from the public container registry [1]. In each report, the failure surfaced at install or pull time in projects that depended on the removed artifact.

Report [1] adds a config-stage factor: one image reference had been missed during an earlier switch to a legacy repository [1]. The fix there listed every image referenced in deployment values and added a CI check [1]. In report [3], a replacement 1.0.0 did not end the errors, because a dependency chain requested version 0.0.3 [3]. The registry then re-published the original 0.0.3 from a backup [3].

Questions

What causes dependency removed from registry?

In report [3], an author unpublished 273 packages from the JavaScript package registry. In report [2], a gem maintainer yanked all builds prior to 0.4.0 to resolve a licensing issue. In report [1], a container image was removed from the public container registry.

What are the symptoms of dependency removed from registry?

Installing any version of the Ruby web framework failed [2]. CI pipelines failed with a NotFound error when pulling the cluster client image [1]. The JavaScript package registry saw hundreds of install failures per minute [3].

Why did tests not catch dependency removed from registry?

Each removal happened after the dependent projects had shipped, so earlier test runs had passed. A configuration check on deployment values does not see versions pinned inside a dependency chain, such as the string padding package 0.0.3 [3].

Which test class catches dependency removed from registry, and what does it miss?

Integration tests and configuration and environment tests are listed, both with the by-design label. PR-01 runs a clean install from the public registries on a daily schedule, so the removal surfaces before a release depends on it.

Which public reports document dependency removed from registry?

Three primary reports from three organisations document it. They were published on 2016-03-23 [3], 2021-03-24 [2] and 2025-09-18 [1].

Should a team roll back or fix forward when dependency removed from registry happens?

Rolling back the application does not restore a removed version, so FM-04 holds releases that need a fresh install. In report [2], the gem maintainer released a compatible 0.3.6 that removed the breakage.

Release Incident Playbook (2026). Dependency removed from registry: symptoms, cause, and the test that catches it, content version 1.0.0. https://releasefailures.com/incidents/dependency-removed-from-registry/. Accessed 2026-10-21.