You’re likely right, but they also might’ve just pulled the version (number) everywhere to make it ‘clearer’ or out of ‘caution’.
replyIs there any industry standard about if a compromised version is distributed via one channel, the owner does or doesn’t drop/bump that same version on unaffected channels too?
You make a good point, my comment above probably overstates things.
replyThere are regularly gaps in the claude code versions, e.g. if you go back a page, there's no 2.1.297, 2.1.298.
replyEdit: the below was incorrect, left for posterity, the release can be deleted and then the tag as well.
Also, all their tags are immutable, and so can't just be deleted to hide things: https://docs.github.com/en/code-security/concepts/supply-cha...
>Also, all their tags are immutable, and so can't just be deleted to hide things
replyYes they can, they can remove the release and then remove the tag.
>If you delete the immutable release, you can delete the tag, but you cannot reuse the same tag name.
You’re right, I read too quickly.
replyNo worries, it's very unexpected. I just remembered because I did the same thing last week and was surprised it worked.
reply