test.sh

#!/usr/bin/env bash

rm -rf node_modules .git package-lock.json package.json .gitignore
git init
echo {} > package.json
echo node_modules > .gitignore
npm i optoolco/tonic#v13.3.2
git add .
git commit -m 'wip'
# then
npm i optoolco/tonic#v13.3.1
git diff
npm -v

Initialized empty Git repository in /Users/isaacs/dev/npm/arborist/fixtures/git-tag-wrong-version/.git/

added 1 package, and audited 2 packages in 12s

found 0 vulnerabilities
[main (root-commit) fdf1761] wip
 4 files changed, 42 insertions(+)
 create mode 100644 .gitignore
 create mode 100644 package-lock.json
 create mode 100644 package.json
 create mode 100644 test.sh

up to date, audited 2 packages in 2s

found 0 vulnerabilities
diff --git a/package-lock.json b/package-lock.json
index d42366e..b2910e1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5,7 +5,7 @@
   "packages": {
     "": {
       "dependencies": {
-        "@optoolco/tonic": "github:optoolco/tonic#v13.3.2"
+        "@optoolco/tonic": "github:optoolco/tonic#v13.3.1"
       }
     },
     "node_modules/@optoolco/tonic": {
@@ -17,7 +17,7 @@
   "dependencies": {
     "@optoolco/tonic": {
       "version": "git+ssh://git@github.com/optoolco/tonic.git#191fd38b3c3eaf6b419ce8f5f38fa4a26940cdaf",
-      "from": "@optoolco/tonic@optoolco/tonic#v13.3.2"
+      "from": "@optoolco/tonic@optoolco/tonic#v13.3.1"
     }
   }
 }
diff --git a/package.json b/package.json
index 8a2ee92..8010065 100644
--- a/package.json
+++ b/package.json
@@ -1,5 +1,5 @@
 {
   "dependencies": {
-    "@optoolco/tonic": "github:optoolco/tonic#v13.3.2"
+    "@optoolco/tonic": "github:optoolco/tonic#v13.3.1"
   }
 }
7.16.0

Expect to see the change in version/resolved values as with https://gist.github.com/isaacs/635b8b128d547a3c50abbe7a0e0238ba