Missing 0.7.0 code/release on GitHub

[tomkins]

I was updating the version of this package we're using on a project, and noticed that PyPI has a 0.7.0 release (https://pypi.org/project/wagtail-draftail-anchors/0.7.0/), however this GitHub repo is only showing 0.6.3 code.

I did double check the contents of the packages out of paranoia - but it looks like it's just something forgotten about during development.

[Mr0grog]

I had a similar reaction and finally had a chance to look into the source myself today. I’d agree with you, @tomkins. AFAICT, nothing looks malicious or dangerous in the 0.7.0 package.

That said, I think I’m going to hold off on upgrading until the code related to this shows up in the repo here.

In case anyone else looking at this thread is curious:

• The wheel and source dist are effectively identical, so that’s good!
• The Python changes are really minor (only in wagtail_hooks.py), and seem to concern the name it registers itself under with Draftail. I don’t really know the internals of Draftail at all, though, so not sure whether this has other subtle impacts.
• The JS appears to have changed some, but mostly has the same structure, functions, and largely similar implementation. It’s hard to tell since the packaged distributions only include minified code, and since Babel is clearly doing different transforms (which makes sense since this is using preset-env, which will change over time) and how Webpack is bundling slugify has also changed (so I’m assuming Webpack was also updated here, but could just be a side-effect of Babel). Hard to tell on the meaningful details what happened.

Anyway, none of the changes look dangerous or malicious here, but it would be nice to know what’s supposed to be in it, and have access to the source!