Composer reads the package's composer.json before honoring tag names —
having "version": "2.0.0" hardcoded means tagging v2.0.1 still resolves
as 2.0.0 to consumers (they can't pick up the bugfix). Best practice :
omit the field and let git tags be the source of truth.