I'm pretty sure you don't release pre-release versions without -pre or -beta or -rc tags in the end.

Technically you don't have to with semver, it's just a good practice. From https://semver.org/:

> A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the patch version.

Note that it says "MAY" and not "MUST", so it's optional.

I'm pretty sure that "we're now changing permissions willy-nilly" is both a breaking change (which would warrant a major version bump, as per semver), and a bug (even though it's presented as an improvement by the authors). I should have been more clear.