Question about release of version 1.0.3

[alexanderkjall]

I'm packing httpdate for debian: https://tracker.debian.org/pkg/rust-httpdate

And there is a version 1.0.3 released on crates.io: https://crates.io/crates/httpdate

And I see that there is a tag for 1.0.3 but the commit doesn't seem to be part of any branch here:

https://github.com/pyfisch/httpdate/commit/638da761065df8b67282b0a1d139c0a7e4a02429

And there is no release here on github for version 1.0.3.

In light of all the recent supply chain attacks I thought it would be best to ask where this inconsistency comes from before upgrading? I hope it doesn't come of the wrong way, better safe than sorry.