npmjs package version not aligned with GitHub repository sources and tags

[vtintillier]

To reproduce:

N/A

Current behavior:

• There is a 4.5.1 version available at https://www.npmjs.com/package/less
• There is no 4.5.1 release in the GitHub repository
• Current version in master is 4.5.0

  less.js/packages/less/package.json

  Line 3 in 6e81606

  "version": "4.5.0",

• There is no 4.5.0 release neither in npmjs or GitHub repository

Expected behavior:

• If there is a 4.5.1 version on npmjs, there is also a 4.5.1 release in GitHub
• If there is a 4.5.1 version on npmjs, there is also a commit where the version is changed to 4.5.1 in GitHub
• If there is a 4.5.1 version on npmjs, there is also a 4.5.0 release first

We have no way of checking if it is safe to upgrade from 4.4.2 to 4.5.1 for now. Was it published from local changes on someone local machine?

Environment information:

N/A

[dosubot]

Hi @vtintillier! I'm Dosu and I’m helping the less.js team.

There is a confirmed misalignment between the npmjs 4.5.1 package and the Less.js GitHub repository. The latest official release in the repository is 4.4.2, with no evidence of a 4.5.0 or 4.5.1 release or tag. While the codebase briefly had a 4.5.1 version (as seen in recent PRs), it was replaced by a 5.0.0-alpha.1 version without any official release or changelog entry for 4.5.0 or 4.5.1. The automated publishing workflow was recently introduced, but there’s no indication that it completed the tagging and release process for 4.5.1, which means the npm package may have been published from a local or uncommitted state rather than a traceable, tagged commit in GitHub (source, source, source, source).

No documentation, changelog, or existing issues address this version misalignment, and there are no reports of security or stability concerns for 4.5.1. However, since the published npm version does not correspond to a tagged release or documented changes in the repository, upgrading from 4.4.2 to 4.5.1 cannot be considered safe or authentic until the repository and release process are aligned.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[lpukatch]

Seems to be a side effect of the workflow from 6e81606 failing

[DLLluoluo]

Another important issue is that less@4.5.1 failed to run in node.js version 14.

The old project we are maintaining uses version 14 of Node.js, which works fine in versions prior to less@4.5.1 but fails in less@4.5.1. This is a serious problem. All third-party libraries that depend on less@4.5.1 will fail to run in node.js version 14.

For more details, please visit #4395