Skip to main content
← Back to list
01Issue
BugClosedSwamp CLITeam
AssigneesNone

Relationships

#1185 extension pull fails permanently when a pinned exact-version dependency is removed from the registry

Opened by webframp · 7/16/2026

swamp extension pull fails permanently once a pinned exact-version dependency is removed from the registry, with no way for the depending extension's author to have caught it ahead of time.

Repro

mkdir /tmp/repro && cd /tmp/repro
swamp repo init .
swamp extension pull @webframp/aws/adopt

Result:

{
  "error": "Extension @swamp/aws/secretsmanager@2026.05.18.1 not found in the registry."
}

@webframp/aws/adopt's manifest pins @swamp/aws/secretsmanager@2026.05.18.1 as an exact dependency. That version no longer resolves via swamp extension info "@swamp/aws/secretsmanager@2026.05.18.1" (also 404s), even though the package itself is very much alive at 2026.06.15.1 (current latestVersion). The two other exact pins in the same manifest — @swamp/aws/ec2@2026.04.03.2 and @swamp/aws/rds@2026.04.23.2, both far older than secretsmanager's current latest — still resolve fine, so this isn't "old versions get pruned on a schedule." Something specific happened to that one version.

This breaks not just adopt but everything that transitively depends on it — e.g. @webframp/aws/drift-state fails to pull with the exact same error, even though drift-state's own manifest has nothing to do with secretsmanager.

Why this is bad

  1. There's no way for an extension author to know a pinned dependency has gone stale until a user's pull breaks. swamp extension quality/push/fmt don't appear to re-verify that declared dependency pins still resolve.
  2. The error message doesn't say why the version is gone (deprecated? security pull? renamed?) or what to do about it — an author debugging this has to manually bisect registry versions to even find the current replacement.
  3. If versions of official @swamp/* extensions can disappear out from under pinned dependents, that's a supply-chain stability issue for the whole ecosystem, not just this one package.

Suggested fixes (any of these would help)

  • Never hard-delete a previously-published version of an extension. If a version must be pulled (security issue, bad publish), keep it resolvable for existing pins but flag it (e.g. "deprecated": true, "reason": "...") rather than 404ing.
  • At minimum, swamp extension quality/push should re-resolve every pinned dependency against the live registry and fail/warn if any no longer exist, so the break is caught by the author at publish time instead of by every downstream user at pull time.
  • The pull error should say why the version is unavailable when known (e.g. "deprecated on 2026-06-xx in favor of 2026.06.15.1") instead of a bare "not found."

Environment

  • swamp 20260716.194319.0-sha.df9fc306
  • swamp auth whoami: webframp
  • Repro'd in a fresh, empty repo (swamp repo init) with no other extensions installed, so this isn't a local-cache artifact.
02Bog Flow
✓OPEN○TRIAGED○IN PROGRESS◉CLOSED

Closed

7/16/2026, 8:47:30 PM

No activity in this phase yet.

03Sludge Pulse
Editable. Press Enter to edit.

stack72 commented 7/16/2026, 8:47:29 PM

This was pulling the wrong version!

Sign in to post a ripple.