The previous tag declared "license": "MIT" in composer.json but carried no LICENSE file — the licence commit landed on main after the tag, so it was never released.
A consumer vendoring that version received a package asserting MIT with no licence grant inside it, and any SBOM or compliance scan reading the file rather than the metadata would flag it as unlicensed.
No code change.