Skip to main content

Rollback

Recover from a harmful package or documentation deployment.

Choose a rollback method that matches the failure. Do not erase public release history.

Package rollback

npm versions are immutable. Do not try to overwrite a published version.

  1. Confirm the defect and affected versions.
  2. Deprecate the harmful version with a short actionable message when needed.
  3. Move a dist-tag only when restoring a known-good version is safer for new installs.
  4. Prepare a patch through the normal protected workflow.
  5. Verify the corrected package and publish an incident note.

Do not unpublish a package unless npm policy permits it and the security or legal need is stronger than the ecosystem breakage risk.

Documentation rollback

Promote the last known-good Vercel deployment or revert the harmful commit by pull request. Confirm the canonical domain after promotion. Keep the failed deployment logs for diagnosis.

Credential rollback

If a credential may be exposed, use the credential incident procedure. A code revert does not revoke a credential.