Could you publish package with same version in hex?

From the f&q (, it sounds like public published package can only be reverted or changed within 1 hour after publication.

But I made a test package and it can successfully publish a package with same version and different code after 1 hour. And I briefly look into the source code( It looks like this is not enforced. I am not sure if this a bug or I misunderstand it.

In general, packages should be immutable for security reason right?

Thank you.

As the FAQ explains, for new packages the window to republish is 24 hours for existing packages the window is 1 hour.