Could you publish package with same version in hex?

Questions & Help Questions
,
1

From the f&q (FAQ | Hex), it sounds like public published package can only be reverted or changed within 1 hour after publication.

But I made a test package and it can successfully publish a package with same version and different code after 1 hour. And I briefly look into the source code(hexpm/lib/hexpm/repository/releases.ex at main · hexpm/hexpm · GitHub). It looks like this is not enforced. I am not sure if this a bug or I misunderstand it.

In general, packages should be immutable for security reason right?

Thank you.

2

As the FAQ explains, for new packages the window to republish is 24 hours for existing packages the window is 1 hour.