WP.org stable tag rollbacks can serve withdrawn versions #78
Description
Problem
WordPress.org plugin authors can roll back their stable release by changing the Stable tag in readme.txt without removing the newer SVN tag. The wp.org API's version field correctly reflects the stable version, but the versions map still includes the rolled-back tag — there's no flag or field to mark a version as withdrawn.
As long as a tag exists in SVN, we serve it in our Composer packages, and Composer/Dependabot/Renovate will resolve or update to it. There's nothing we can do about this without upstream changes to the wp.org API.
Recommended mitigation
Use the WP Packages Changelog Action in CI to get PR comments that warn when an installed version doesn't match the wp.org stable tag.