Published 0.15.0 is not built from the commit tagged as v0.15.0

[avendiart]

In version 0.15.0, I’m seeing a regression where organizationId is null on initial load. This does not occur in 0.14.0.

When reviewing the tagged source diff between v0.14.0 and v0.15.0 (v0.14.0...v0.15.0), I couldn’t identify a change that would plausibly introduce this behavior. However, after inspecting the published dist artifact, it appears to include modifications that are not present in the repository sources for the v0.15.0 tag.

This suggests the currently published 0.15.0 package was not built from the commit associated with the v0.15.0 tag. I’m not sure what happened during the release process, but this breaks the expected traceability between tagged commits and published artifacts.

Beyond the functional regression, this also raises a broader concern: if published artifacts are not reproducibly built from the corresponding tagged commits, it becomes difficult to assess whether this discrepancy could represent a supply-chain/security risk going forward.

[nicknisi]

Hey @avendiart thanks for reporting this. I'm reviewing to see what happened and will report back with my findings. Thanks!

[nicknisi]

Thanks for the detailed report, @avendiart. You're right. There's a mismatch between the tagged source and the published artifact.

What happened:
Our automated release workflow failed due to a misconfiguration in npm's Trusted Publishers, and this was the first release to go out since setting that up. The package was then published manually, but from a build that didn't match the tagged commit.

What's affected in 0.15.0:

• Missing the authenticationMethod feature
• organizationId regression you observed

Fix:
We've corrected the Trusted Publishers config and are releasing 0.15.1 with the correct build. We'll deprecate 0.15.0.

Thanks for the thorough analysis. It helped us identify both the artifact mismatch and the underlying CI issue.

[avendiart]

@nicknisi I can confirm the regression has been fixed.