When uploading an update to an existing package, the front-end makes the same assumption as when editing meta data. "No name" means "name from package".
It looks like the API agrees in the validation step, since it does not complain about missing stuff in the GET /new-package/.

However, .../publish gives 500:

2020-04-25 21:48:46 ERROR Error handling request
Traceback (most recent call last):
File "/usr/local/lib/python3.8/site-packages/aiohttp/web_protocol.py", line 418, in start
resp = await task
File "/usr/local/lib/python3.8/site-packages/aiohttp/web_app.py", line 458, in _handle
resp = await handler(request)
File "/code/bananas_api/web_routes/new.py", line 194, in new_publish
publish_session(session)
File "/code/bananas_api/new_upload/session.py", line 232, in publish_session
create_tarball(session)
File "/code/bananas_api/new_upload/session_publish.py", line 112, in create_tarball
tar_path = _safe_name(session["name"]) + "-" + _safe_name(session["version"])
KeyError: 'name'
2020-04-25 21:48:46 INFO 172.17.0.1 [25/Apr/2020:21:48:46 +0000] "POST /new-package/3a6ad88d8398ed157f8e8af1f9c5157c/publish HTTP/1.1" 500 244 "-" "python-requests/2.23.0"