The yanked flag should not be ignored

[whitphx]

Currently micropip.install() ignores the yanked flag and even installs the yanked version.
For example, as of 2024-10-22, micropip.install("python-multipart") installs 0.0.13 even though the version is yanked.

>>> import micropip
>>> await micropip.install("python-multipart")
>>> import python_multipart
>>> python_multipart.__version__
'0.0.13'

---

As a reference, pip deals with the yank flag properly, as the yanked python-multipart==0.0.13 is ignored as below for example.

.venv ❯ pip install python-multipart
Collecting python-multipart
  Obtaining dependency information for python-multipart from https://files.pythonhosted.org/packages/f5/0b/c316262244abea7481f95f1e91d7575f3dfcf6455d56d1ffe9839c582eb1/python_multipart-0.0.12-py3-none-any.whl.metadata
  Downloading python_multipart-0.0.12-py3-none-any.whl.metadata (1.9 kB)
Downloading python_multipart-0.0.12-py3-none-any.whl (23 kB)
Installing collected packages: python-multipart
Successfully installed python-multipart-0.0.12

[hoodmane]

Thanks for the report! Sounds like it's probably a quick fix.

[ryanking13]

Thanks for the report. The Simple JSON API contains "yanked" flag, so it would be possible to use that flag to skip the package.

Are you interested in making a PR?

[whitphx]

Thanks, yes I would like to give it a try.

[whitphx]

I drafted a PR. Can you take a look?

[whitphx]

Sorry but implementing https://peps.python.org/pep-0592/#installers into the current code would be complicated and requires more code changes, and I think the core maintainer should do it.
Let me close my PR and hand it over.
fyi, pypa/pip does it like this: https://github.com/pypa/pip/blob/6958e28f366f00373343efcd5a7e776a810cb133/src/pip/_internal/resolution/resolvelib/factory.py#L314-L344

[ryanking13]

@whitphx Sure. Thanks for the code pointer. Let me take it over and have a look