29 of the 100 most-downloaded PyPI projects have a version that names two different code states

Description and use

29 of the 100 most-downloaded PyPI projects have duplicate version tags pointing to different code states. The author created the closure-drift tool to detect these conflicts.

Problem

Two release tags can declare the same version while pointing to different code, causing ambiguity for users and tools.

Outcome

29 of the 100 most-downloaded PyPI projects had at least one duplicate version tag pointing to different code states.

Workflow

• 1. Build a tool to compare code states for identical version tags.
• 2. Run the tool on the 100 most-downloaded PyPI projects with public repos.
• 3. Record results: 59 projects had unique versions, 29 had duplicates, 4 had insufficient tags, 8 inconclusive.
• 4. Publish findings and the tool (closure-drift).

Evidence

Every collision is listed and can be checked by hand. In requests:

I built a small tool to check it and ran it on the 100 most-downloaded PyPI projects with a public repository.

Every collision is listed and can be checked by hand. In requests: $ closure-drift --compare v2.16.0 v2.16.1 DIFFERS UNDER ONE LABEL: both declare 2.16.0, and the code differs in 2 path(s).