Missing 4.0.0 tag and release

[rnorth]

We've noticed that 4.0.0 is the latest version of the awslambdaric package on pypi, corresponding to changes in #200.

However, it seems that there's no corresponding release or git tag. The lack of the release causes incomplete Dependabot PRs, and the lack of a tag is slightly concerning from a supply chain security perspective. We are not sure that 4.0.0 contained any actual breaking changes.

Please could you create the missing release/tag, and/or advise on whether you've switched to a different versioning/release process?

[maxday]

Thanks for flagging this @rnorth !
You're right that the missing release and git tag is confusing, and we completely understand the supply chain security concerns. We're actively working on addressing this and will add the appropriate tags to make it easier to track going forward. We'll update the issue once we have it sorted out.

[rnorth]

@maxday fantastic, that's great to hear and thanks for the quick reply. Thank you 🙇‍♂️

[vip-amzn]

Hi, thanks for raising this. We've released v4.0.1, and #210 added release automation so that going forward a GitHub Release and tag are created for every version bump.

Please reopen if you have any other queries.