The only time a version bump is needed is for a different SHA1; for "rewriteable" version numbers like `0.0.0` or `0.3.1-` we've agreed that it's acceptable to change even the SHA1.