# New pack versions

**URL:** <https://swi-prolog.discourse.group/t/new-pack-versions/4031>\
**Category:** General\
**Created:** [June 6, 2021, 10:42am UTC](https://swi-prolog.discourse.group/t/new-pack-versions/4031 "2021-06-06T10:42:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![esad](https://yyz2.discourse-cdn.com/free1/user_avatar/swi-prolog.discourse.group/esad/32/884_2.png) [@esad](https://swi-prolog.discourse.group/u/esad)\
**Post date:** [June 6, 2021, 10:42am UTC](https://swi-prolog.discourse.group/t/new-pack-versions/4031/1 "2021-06-06T10:42:51Z")

</div>

Hi there,

while installing pack `func` today, I’ve noticed that fresh SWI Prolog install has asked me if I want to install from my own fork - I thought it was some crazy magic happening, but it seems my fork got picked up as new version and is listed at ["func" pack for SWI-Prolog](https://www.swi-prolog.org/pack/list?p=func)

Did this happen automatically or did someone manually add it?

I am curious, because if this happens automatically, it’s a huge security issue, because anybody could make a fork of any pack, bump the version and insert arbitrary code.

---

<div class="post-metadata">

**Author:** ![jan](https://yyz2.discourse-cdn.com/free1/user_avatar/swi-prolog.discourse.group/jan/32/4_2.png) [@jan](https://swi-prolog.discourse.group/u/jan)\
**Post date:** [June 6, 2021, 11:12am UTC](https://swi-prolog.discourse.group/t/new-pack-versions/4031/2 "2021-06-06T11:12:29Z")

</div>

Oops. Turned out you could get a new download location registered by changing the install type from archive to git or the other way around. I patched that hole.

I guess the new download for func should be removed?

---

<div class="post-metadata">

**Author:** ![esad](https://yyz2.discourse-cdn.com/free1/user_avatar/swi-prolog.discourse.group/esad/32/884_2.png) [@esad](https://swi-prolog.discourse.group/u/esad)\
**Post date:** [June 6, 2021, 11:20am UTC](https://swi-prolog.discourse.group/t/new-pack-versions/4031/3 "2021-06-06T11:20:20Z")

</div>

It’s a tiny bugfix for an edge case I encountered, but I’m not 100% confident that it doesn’t break anything so I’d remove it 🙂
