Tagging before the version bump: what I found in the 2026 tags of 1,200 repositories
A common release slip: you create the tag v1.16.0 and only then bump the version in the file. The tag points at a commit that still says 1.15.2 . Usually nothing breaks right away. But git checkout v1.16.0 gives you different code, and some package registries record the commit a version was really built from, which is not the one the tag names. I checked the tags created in 2026 in about 1,200…
Release tagging practices reveal gaps in version consistency across thousands of open-source projects. A study of 1,200 repositories across major package registries and platforms shows that many tags do not accurately reflect the commit's declared version. This discrepancy can lead to unintended code changes and errors when developers check out tagged versions.
The issue arises when tags are created before the associated version is bumped in the codebase. For example, smallvec (Rust) tags v1.16.0 but points to a commit declaring 1.15.2, while pytest-timeout's tag 2.5.0 was created with the outdated setup.cfg value of 2.4.0. Even my own checks revealed mismatches, often due to pre-releases or build metadata, which were not included in my initial testing data.
To prevent these issues, the study recommends tagging only after the version has been updated in the code, or using automated workflows that create tags based on the version file. The authors provide a tool called closure_drift to help verify tagging accuracy, and their findings are available for public review.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.