Version 4.6.4 available on NPM without a corresponding git tag?

[mflorea]

Hi,

I noticed a new version is available on NPM https://www.npmjs.com/package/less/v/4.6.4 , but there is no corresponding tag on git AFAICS https://github.com/less/less.js/tags . Is that normal? With the recent surge in supply chain attacks I try to be more careful with upgrades and this inconsistency caught my eye.

Thanks!

[sueun-dev]

yeah, I can reproduce the mismatch.

I checked the npm registry and less@4.6.4 is live, but git ls-remote --tags https://github.com/less/less.js.git 'refs/tags/*4.6*' only shows v4.6.0 and v4.6.3, no v4.6.4. The weird bit is that npm metadata for both 4.6.3 and 4.6.4 reports the same gitHead (1df9072...), while current master still has packages/less/package.json at 4.6.3.

Can't speak for the maintainers, but I wouldn't treat 4.6.4 as GitHub-tag-verifiable rn. I'd wait for a tag/release note or maintainer confirmation before upgrading.

[lelgenio]

@matthew-dean, Maybe you could clear this up for us?

I'm waiting on the tag for the new version to publish on nixpkgs, since the previous versions uses the now EOL pnpm v9.

Ref: NixOS/nixpkgs#529285
Ref: NixOS/nixpkgs#530129

[mflorea]

More recent tags (4.6.5+) are now available. 4.6.4 is still missing, but I can upgrade to a more recent version.