Invalid package metadata versions?

[bepri]

I think the METADATA files distributed with attrs versions 23.2.0 and 24.2.0 specify a Metadata-Version that is too low for the keys they contain. According to the METADATA specification, the License-Expression and License-File keys are not supported until v2.4, but the two versions I tested use those keys and claim to be using v2.1 and v2.3, respectively.

When parsing the METADATA file for attrs-23.2.0 with packaging.metadata.parse_email(), I get the following exception:

packaging.metadata.ExceptionGroup: ('unparsed', [InvalidMetadata("unrecognized field: 'license-file'"), InvalidMetadata("unrecognized field: 'license-expression'")])