Deprecate a package version

Deprecate package foo-lib version 1.8.2 in the public registry and mark it as insecure with the provided security advisory. Update the package deprecation notice to recommend 2.x, include the migration note and a link to our upgrade guide, and confirm that the UI shows the deprecation banner within an hour. Inform the security list when done.

Before I mark 1.8.2 as deprecated, make the deprecation clear for users: surface the security reason and the suggested replacement at the top of the package page, add the minimal migration steps and a compatibility table for 1.x to 2.x, and flag any dependent packages in our org that still require 1.8.2 so we don’t break internal consumers unexpectedly.

Legal has asked me to deprecate version 1.8.2 citing policy concerns, but I discovered two internal services still reference that exact version. I don’t know whether those services can switch promptly or whether deprecation will break automated deploys. Who do I contact to confirm internal dependencies, what checks show whether deprecation will block deploy pipelines, and what limited deprecation wording or grace period minimizes risk while complying with Legal’s request?

We’ve had three incidents where a public deprecation step broke internal consumers because we didn’t track org-wide dependents or provide a grace period. Where are we losing control—dependency visibility, ownership of client updates, or communication—and what standard, enforceable habit should we adopt so deprecations never surprise internal teams again? Give the exact check, who must own it, and a measurable outcome to prevent recurrence.