API returns inconsistent releases list

[faust64]

🏷️ Discussion Type

Bug

💬 Feature/Topic Area

API

Body

Issue was already described in https://github.com/orgs/community/discussions/204372

Today, querying GitHub API for the list of releases in hashicorp/terraform-provider-http, we would miss their latest release.

$> curl "https://api.github.com/repos/hashicorp/terraform-provider-http/releases"| yq -r '.[] | {.name: .tag_name}'
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 93606    0 93606    0     0   219k      0 --:--:-- --:--:-- --:--:--  219k
"v3.6.0": "v3.6.0"
"v3.5.0": "v3.5.0"
"v3.4.5": "v3.4.5"
"v3.4.4": "v3.4.4"
"v3.4.3": "v3.4.3"
"v3.4.2": "v3.4.2"
"v3.4.1": "v3.4.1"
"v3.4.0": "v3.4.0"
"v3.3.0": "v3.3.0"
"v3.2.1": "v3.2.1"
"v3.2.0": "v3.2.0"
"v3.1.0": "v3.1.0"
"v3.0.1": "v3.0.1"
"v3.0.0": "v3.0.0"
"v2.2.0": "v2.2.0"

Yet there is a v3.6.1, which is not a draft, nor a prerelease:

$> curl "https://api.github.com/repos/hashicorp/terraform-provider-http/releases/tags/v3.6.1"
{
  "url": "https://api.github.com/repos/hashicorp/terraform-provider-http/releases/370610095",
  "assets_url": "https://api.github.com/repos/hashicorp/terraform-provider-http/releases/370610095/assets",
  "upload_url": "https://uploads.github.com/repos/hashicorp/terraform-provider-http/releases/370610095/assets{?name,label}",
  "html_url": "https://github.com/hashicorp/terraform-provider-http/releases/tag/v3.6.1",
  "id": 370610095,
  "author": {
    "login": "hc-github-team-es-release-engineering",
    "id": 82989873,
    "node_id": "MDQ6VXNlcjgyOTg5ODcz",
    "avatar_url": "https://avatars.githubusercontent.com/u/82989873?v=4",
    "gravatar_id": "",
    "url": "https://api.github.com/users/hc-github-team-es-release-engineering",
    "html_url": "https://github.com/hc-github-team-es-release-engineering",
    "followers_url": "https://api.github.com/users/hc-github-team-es-release-engineering/followers",
    "following_url": "https://api.github.com/users/hc-github-team-es-release-engineering/following{/other_user}",
    "gists_url": "https://api.github.com/users/hc-github-team-es-release-engineering/gists{/gist_id}",
    "starred_url": "https://api.github.com/users/hc-github-team-es-release-engineering/starred{/owner}{/repo}",
    "subscriptions_url": "https://api.github.com/users/hc-github-team-es-release-engineering/subscriptions",
    "organizations_url": "https://api.github.com/users/hc-github-team-es-release-engineering/orgs",
    "repos_url": "https://api.github.com/users/hc-github-team-es-release-engineering/repos",
    "events_url": "https://api.github.com/users/hc-github-team-es-release-engineering/events{/privacy}",
    "received_events_url": "https://api.github.com/users/hc-github-team-es-release-engineering/received_events",
    "type": "User",
    "user_view_type": "public",
    "site_admin": false
  },
  "node_id": "RE_kwDOBZHfoM4WFw-v",
  "tag_name": "v3.6.1",
  "target_commitish": "be89f04ea469e9a7f361a39e58ef79a7a533990e",
  "name": "v3.6.1",
  "draft": false,
  "immutable": false,
  "prerelease": false,
  "created_at": "2026-08-14T13:26:59Z",
  "updated_at": "2026-08-14T13:59:47Z",
  "published_at": "2026-08-14T13:59:47Z",
  "assets": [

  ],
  "tarball_url": "https://api.github.com/repos/hashicorp/terraform-provider-http/tarball/v3.6.1",
  "zipball_url": "https://api.github.com/repos/hashicorp/terraform-provider-http/zipball/v3.6.1",
  "body": "## 3.6.1 (August 14, 2026)\n\nNOTES:\n\n* The StateStore lock request no longer passes the 'Path' or 'Info' fields as we no longer have access to those fields from within the provider ([#602](https://github.com/hashicorp/terraform-provider-http/issues/602))\n* Dependency updates which address upstream CVEs. ([#626](https://github.com/hashicorp/terraform-provider-http/issues/626))\n\n"
}

From UI, v3.6.1 is set as "latest" release:

How is that possible?

I won't be able to update releases myself, given this is not one of my repositories.
Is there anyting we could do, to get a consistent list of releases out of that repository?

[iawaisahmd]

since the tag-specific endpoint returns v3.6.1 while the collection endpoint omits it, this looks like an indexing or cache inconsistency rather than a release configuration issue. as a workaround, consumers that need the newest release might compare /releases/latest with the paginated /releases result instead of trusting the collection alone. i'd also include the release id and timestamps from v3.6.1 in the bug report, since they show the release exists normally but is missing only from the listing endpoint.

[tahleho3968]

Likely explanations, in order of probability:

1. Index lag on the collection endpoint. GET /releases is served from GitHub's releases index, while /releases/tags/{tag} reads the release record directly. A very recent publish (v3.6.1, created Aug 14) can momentarily lag the listing — which is exactly the asymmetry you're seeing. Worth re-checking whether the listing shows v3.6.1 now; if it does, it was transient.
2. Pagination. The default page size is 30, and consumers must follow the Link headers (or pass page). In your sample you only received 15 entries on page 1, so this isn't the cause here — but it's the most common reason a "latest release" appears missing in scripts.
3. Canonical "latest" endpoint. GET /releases/latest is GitHub's maintained notion of the newest release (highest semver that is not a draft/prerelease). Since v3.6.1 is latest, non-draft, non-prerelease, that endpoint should return it even while the listing lags.

Given the listing omits v3.6.1 while the tag endpoint, the latest endpoint, and the UI all agree it exists, this is an indexing inconsistency on GitHub's side (same symptom as #204372). What you can do:

• In consumers, resolve the newest release via GET /releases/latest first, then paginate the /releases listing from there, rather than trusting the first page alone.
• Nudge a re-index by re-hitting the listing after some time; if it stays stale, open a GitHub Support ticket quoting both responses (collection vs. tag) and reference GitHub Release missing from Releases list and REST API but accessible by tag #204372.

On hashicorp/terraform-provider-http's side there's nothing misconfigured — a draft or prerelease is the only case where a published tag is deliberately excluded from the listing, and v3.6.1 is neither.