Published packages should be immutable. Sure, "unpublish" so it's no longer listed. Even display scary messages in your package manager's stdout. But once you publish a package, any package manager with the hash of the package contents in its lockfile should be able to continue retrieving it indefinitely. The fact that it's possible for any maintainer to break all consumers of their previously published works on a whim is insane to me.
If pypi didn't enforce size limits, I'd agree with you. We routinely have to delete older versions of our package to make space for newer versions.
A thousand times this. Immutability, reproducibility, traceability.
What irks one the most is the arbitrary discrimination between 'critical' and 'non-critical' maintainers. Use TOTP for everybody and be done with it.
"X wanted me to do Y, which I don't want to do and unambiguously have no obligation to do. I did Z out of curiosity. It broke more things than intended, so I fixed them."
That hardly sounds like a snit.
how embarrassing to have such a janky CI pipeline!