strange Syphon listings in sources.conf

Something strange is going on with Syphon in sources.conf that I don't understand.

sources.conf lists two urls for Syphon (why?):

041 \ https://github.com/Syphon/Processing/releases/download/latestv2/Syphon.txt
148 \ https://github.com/Syphon/Processing/releases/download/latest/Syphon.txt

The first one ("latestv2") points to an old release from 2015, version 3 / prettyVersion 1.0-RC3. That link works.

The second is supposed to be the latest release, but the url is 404. The home repo accidentally manually tagged an outdated 2017 release d36fcaf with "latest" -- this broke the github auto-latest download path. The repo needs to remove their manual "latest" tag, then the auto-latest url will work again.

However -- when opening PDE Contributions Manager, Syphon is listed, and it does not download either version listed in sources.conf, neither the 2015 version, nor the 404.

Instead it downloads the correct true latest release, version 8 / prettyVersion 3 --which is available at https://github.com/Syphon/Processing/releases/download/3/Syphon.txt, and is NOT listed in sources.conf at all.

I have no idea how it is doing that. Help me understand? @REAS @prisonerjohn

This will help me adjust the code on my Processing community archiving software that checks for 404 contributions.