Dependency removed from registry: pre-release and first 30 minutes checklists

A package or version is pulled from a registry and builds or deploys fail.

The pre-release checklist maps each item to a test class from the incident page. The first-30-minutes checklist covers detection, containment, the rollback decision and customer communication.

6 pre-release items · 7 first-30-minutes items · verified 2026-10-22

Pre-release checklist

PR-01Run a clean dependency install from the public registries with no local cache on a daily CI schedule and fail on any package or version that is not found. integration
PR-02Install the application from a clean environment with the committed lockfile and confirm every locked gem version, such as the MIME type gem 0.3.5, still resolves. integration
PR-03Pull every container image the release references, including images set inside policy chart jobs, on a clean node before deploy. integration
PR-04List every image referenced in deployment values and fail CI when one points at a repository that has been removed or moved. config
PR-05After a repository switch, confirm that every image reference, including the policy reports cleanup job, points at the new repository. config
PR-06Point the build at a registry mirror the team controls and confirm it holds each pinned version, including transitive pins such as string padding 0.0.3. config

First 30 minutes

FM-01Read the install or pull error and record the exact package, version or image tag that no longer resolves.
FM-02Check the registry page and the dependency's issue tracker for an unpublish, yank or image removal notice.
FM-03Trace which direct dependency pins the missing version, using the lockfile or the dependency tree.
FM-04Hold releases that need a fresh install, because rolling back the application does not restore a removed version.
FM-05Restore the build with a cached or mirrored copy of the exact missing version, or with a compatible replacement version.
FM-06Point affected image references at the legacy or replacement repository and rerun the failed pipelines.
FM-07Tell teams that share the pipelines which package or image is missing and which override restores the build.

Download the checklist

Pre-release checklist (Markdown)1.4 KB · v1.0.0
First 30 minutes checklist (Markdown)1.1 KB · v1.0.0

Only in this checklist

Every test class in this checklist also appears in at least one sibling checklist in the group; the item texts differ: Run a clean dependency install from the public registries with no local cache on a daily CI schedule and fail on any package or version that is not found.

Questions

What should be checked before a release to prevent Dependency removed from registry?

6 pre-release items, PR-01 to PR-06. PR-01: Run a clean dependency install from the public registries with no local cache on a daily CI schedule and fail on any package or version that is not found.

Is there a rollback plan for Dependency removed from registry?

The first-30-minutes checklist has 7 items. FM-01: Read the install or pull error and record the exact package, version or image tag that no longer resolves.

What should a team do in the first 30 minutes after Dependency removed from registry is detected?

The first-30-minutes checklist has 7 items. FM-01: Read the install or pull error and record the exact package, version or image tag that no longer resolves.

Which configuration checks apply to Dependency removed from registry?

PR-04: List every image referenced in deployment values and fail CI when one points at a repository that has been removed or moved. PR-05: After a repository switch, confirm that every image reference, including the policy reports cleanup job, points at the new repository. PR-06: Point the build at a registry mirror the team controls and confirm it holds each pinned version, including transitive pins such as string padding 0.0.3.

Is a Dependency removed from registry checklist still needed if deployment is automated?

Yes. Automation runs the steps; the checklist names what the tests must cover: integration tests and configuration and environment tests.

Which pipeline stages does the Dependency removed from registry checklist cover?

The pre-release items map to the pre-deploy and post-deploy stages.