Hallucinated plugin updates

[mattradford-sage]

Dependabot raised 3 PRs for me to update with the following Composer changes as described by WPackagist:

"wpackagist-plugin/redirection":"5.5"
"wpackagist-plugin/skyword-plugin":"2.5"
"wpackagist-plugin/skyword-publishing-api":"1.0.9"

When I merged these PRs and ran composer update, I was confused why the plugins had not updated to the specified versions. It was because those versions as described by WPackagist don't exist.

https://wordpress.org/plugins/redirection/ - latest version is 5.4.1 https://wordpress.org/plugins/skyword-plugin/ - latest version is 2.4.9 https://wordpress.org/plugins/skyword-publishing-api/ - latest version is 1.0.8

[NoelLH]

Hey @mattradford-sage, I just focused in on skyword-plugin but it looks like it is probably a case of odd things happening "upstream" of Wpackagist:

• There is a tag 2.5 in svn here: https://plugins.trac.wordpress.org/browser/skyword-plugin/#tags/2.5
• Its age is allegedly 3 years (the newest) despite the plugin page showing an update time of 6 months ago – perhaps an 'unpublish' that wasn't done fully?

I expect the other plugin from the same vendor will be similar.

redirection appears to have been last updated today and Wpackagist web shows its latest tag as 5.4.1. Perhaps they did an unpublish too but were more consistent about it and left svn in a valid state? In cases like that you can press the refresh button in the WPackagist web UI to get the latest version metadata for a specific package quicker than it would update on its own.

I don't think there's anything we can do on the Wpackagist side for any of these cases but please let me know if I've missed something.

[mattradford-sage]

Thanks for the investigation and explanation @NoelLH :)