29 of the 100 most-downloaded PyPI projects have a version that names two different code states

说明与用途

在100个最受欢迎的PyPI项目中，有29个项目存在同一版本号指向不同代码状态的情况。作者创建了closure-drift工具来检测此类冲突。

问题

Two release tags can declare the same version while pointing to different code, causing ambiguity for users and tools.

结果

29 of the 100 most-downloaded PyPI projects had at least one duplicate version tag pointing to different code states.

工作流

• 1. Build a tool to compare code states for identical version tags.
• 2. Run the tool on the 100 most-downloaded PyPI projects with public repos.
• 3. Record results: 59 projects had unique versions, 29 had duplicates, 4 had insufficient tags, 8 inconclusive.
• 4. Publish findings and the tool (closure-drift).

证据

Every collision is listed and can be checked by hand. In requests:

I built a small tool to check it and ran it on the 100 most-downloaded PyPI projects with a public repository.

Every collision is listed and can be checked by hand. In requests: $ closure-drift --compare v2.16.0 v2.16.1 DIFFERS UNDER ONE LABEL: both declare 2.16.0, and the code differs in 2 path(s).