npmjs package version not aligned with GitHub repository sources and tags

[vtintillier]

To reproduce:

N/A

Current behavior:

• There is a 4.5.1 version available at https://www.npmjs.com/package/less
• There is no 4.5.1 release in the GitHub repository
• Current version in master is 4.5.0

  less.js/packages/less/package.json

  Line 3 in 6e81606

  "version": "4.5.0",

• There is no 4.5.0 release neither in npmjs or GitHub repository

Expected behavior:

• If there is a 4.5.1 version on npmjs, there is also a 4.5.1 release in GitHub
• If there is a 4.5.1 version on npmjs, there is also a commit where the version is changed to 4.5.1 in GitHub
• If there is a 4.5.1 version on npmjs, there is also a 4.5.0 release first

We have no way of checking if it is safe to upgrade from 4.4.2 to 4.5.1 for now. Was it published from local changes on someone local machine?

Environment information:

N/A

[dosubot]

Hi @vtintillier! I'm Dosu and I’m helping the less.js team.

There is a confirmed misalignment between the npmjs 4.5.1 package and the Less.js GitHub repository. The latest official release in the repository is 4.4.2, with no evidence of a 4.5.0 or 4.5.1 release or tag. While the codebase briefly had a 4.5.1 version (as seen in recent PRs), it was replaced by a 5.0.0-alpha.1 version without any official release or changelog entry for 4.5.0 or 4.5.1. The automated publishing workflow was recently introduced, but there’s no indication that it completed the tagging and release process for 4.5.1, which means the npm package may have been published from a local or uncommitted state rather than a traceable, tagged commit in GitHub (source, source, source, source).

No documentation, changelog, or existing issues address this version misalignment, and there are no reports of security or stability concerns for 4.5.1. However, since the published npm version does not correspond to a tagged release or documented changes in the repository, upgrading from 4.4.2 to 4.5.1 cannot be considered safe or authentic until the repository and release process are aligned.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[lpukatch]

Seems to be a side effect of the workflow from 6e81606 failing

[DLLluoluo]

Another important issue is that less@4.5.1 failed to run in node.js version 14.

The old project we are maintaining uses version 14 of Node.js, which works fine in versions prior to less@4.5.1 but fails in less@4.5.1. This is a serious problem. All third-party libraries that depend on less@4.5.1 will fail to run in node.js version 14.

For more details, please visit #4395

[vtintillier]

Hello @matthew-dean and @puckowski
Could you please clarify if 4.5.1 is ok to use or if it is some kind of alpha level release?
Would be nice to at least acknowledge the issue by maybe creating a GitHub release manually?
Thanks

[puckowski]

I did not review the latest auto-deploy changes, but as far as I can see:

4.5.0 was meant to be deployed with new auto deploy changes but ran into issues.
4.5.1 was the first successful deploy using the new auto deploy changes.

I've run some basic checks on the npm version 4.5.1 and that Less version seems to be working as expected so far, but I need more time to review the npm release and the latest auto-deploy code/configuration.

I've manually put together the last few GitHub releases. I hope I can find some time this weekend to put together a GitHub release for 4.5.1. Maybe GitHub releases will also be auto-deployed in the future.

[puckowski]

I'll try to assess Node 14 support sometime this week.