tomasr78 · Nov 12, 2026 · Nov 12, 2026 · Nov 12, 2026
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -6,14 +6,14 @@ run-name: Publishing convertapi-js ${{ github.event.release.tag_name }} to npm
 # publishes it to npm with provenance. npm versions are public and permanent - a published version can be
 # deprecated but never replaced - so nothing here retries, overwrites or skips a duplicate.
 #
-#   gh release create v1.1.10 --target main --generate-notes                  -> convertapi-js 1.1.10 (module)
+#   gh release create v1.1.12 --target main --generate-notes                  -> convertapi-js 1.1.12 (latest)
 #   gh release create v1.2.0-beta.1 --target main --prerelease ...            -> convertapi-js 1.2.0-beta.1 (next)
 #
-# The npm dist-tag `latest` is deliberately left on 1.0.8, the last non-module (script tag) build from the
-# `last_nonmodule` git tag, and the ES module line (1.1.x, this branch) is published under the dist-tag
-# `module`; the README installs it with `npm i convertapi-js@~1.1`. Moving `latest` to the module line would
-# change what `npm i convertapi-js` and unversioned CDN URLs serve, so it is a separate, deliberate step
-# (`npm dist-tag add convertapi-js@X.Y.Z latest`), not something a release does.
+# A stable release takes the npm dist-tag `latest`, so `npm i convertapi-js` and unversioned CDN URLs get the
+# ES module build that the README and convertapi.com document. Releases up to 1.1.11 went to the dist-tag
+# `module` instead, which stays on 1.1.11, while `latest` was kept on 1.0.8, the last non-module (script tag)
+# build from the `last_nonmodule` git tag. A page that still loads that build with a script tag must pin it:
+# https://unpkg.com/convertapi-js@1.0.8/lib/convertapi.js
 #
 # A stable version must be a commit on main. A pre-release may be any commit, so a branch can be tried
 # out as a preview package before it is merged.
@@ -30,7 +30,7 @@ env:
   # admins create v* tags) and the npm environment, which accepts only v* tags.
   PUBLISHER: tomasr78
   PACKAGE: convertapi-js
-  STABLE_DIST_TAG: module
+  STABLE_DIST_TAG: latest
   CONVERT_API_HOST: stag-v2.convertapi.com
 
 jobs:

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,12 +1,22 @@
 # Changelog
 
 All notable changes to the `convertapi-js` npm package. Versions follow [Semantic Versioning](https://semver.org/);
-from 1.1.10 on each one is a GitHub Release `v{version}` (see [RELEASING.md](RELEASING.md)). Stable 1.1.x
-versions are published under the npm dist-tag `module`; `latest` stays on the non-module 1.0.8.
+from 1.1.10 on each one is a GitHub Release `v{version}` (see [RELEASING.md](RELEASING.md)). Stable
+versions are published under the npm dist-tag `latest`; up to 1.1.11 they went to the dist-tag `module`,
+and `latest` stayed on the non-module 1.0.8.
 
-## 1.1.10 - 2026-10-20
+## Unreleased
+
+- Stable releases take the npm dist-tag `latest` instead of `module`, so `npm i convertapi-js` and
+  unversioned CDN URLs get the ES module build. `latest` was moved from 1.0.8 to 1.1.11 on 2026-11-12
+  (`npm dist-tag add`). `module` stays on 1.1.11. A page that loads the non-module
+  1.0.8 with an unversioned script tag must pin it: https://unpkg.com/convertapi-js@1.0.8/lib/convertapi.js
+
+## 1.1.11 - 2026-10-20
 
 - No change to the library code.
+- The GitHub Release v1.1.10 did not reach npm (its publish step failed, fixed in
+  https://github.com/ConvertAPI/convertapi-library-js/pull/28), so npm has no 1.1.10; 1.1.11 is the same code.
 - `package.json` points at the renamed repository, https://github.com/ConvertAPI/convertapi-library-js,
   and names the type declarations (`types`).
 - The README's remote-file example uses a file that exists
@@ -25,5 +35,5 @@ versions are published under the npm dist-tag `module`; `latest` stays on the no
 
 ## 1.0.8 - 2022-06-21
 
-- Last non-module build (git tag `last_nonmodule`), still the npm dist-tag `latest`. Authenticates with
-  the retired secret or API key and token in the query string.
+- Last non-module build (git tag `last_nonmodule`). It kept the npm dist-tag `latest` until the ES module
+  line took it over. Authenticates with the retired secret or API key and token in the query string.
diff --git a/README.md b/README.md
@@ -11,6 +11,7 @@ The ConvertAPI-JS library makes it easier to use the Convert API from your web p
 You can get your token at https://www.convertapi.com/a/authentication
 
 If you are interested in our old version of **non-module** JavaScript library you can [find it here](https://github.com/ConvertAPI/convertapi-library-js/tree/last_nonmodule).
+To load it with a script tag, pin its version: `<script src="https://unpkg.com/convertapi-js@1.0.8/lib/convertapi.js"></script>`.
 
 ## Try it online
 

diff --git a/RELEASING.md b/RELEASING.md
@@ -18,7 +18,7 @@ CONVERT_API_SECRET=<staging token> CONVERT_API_HOST=stag-v2.convertapi.com npm t
 A release is a **GitHub Release** whose tag is the version, published by `tomasr78`:
 
 ```bash
-gh release create v1.1.10 --repo ConvertAPI/convertapi-library-js --target main --title v1.1.10 --generate-notes
+gh release create v1.1.12 --repo ConvertAPI/convertapi-library-js --target main --title v1.1.12 --generate-notes
 ```
 
 That runs `.github/workflows/publish.yml` in the `npm` environment (deployable from `v*` tags only), which:
@@ -40,15 +40,21 @@ GitHub Actions, organization or user `ConvertAPI`, repository `convertapi-librar
 
 | Dist-tag | Gets | Installed with |
 |---|---|---|
-| `latest` | `1.0.8`, the last **non-module** build (git tag `last_nonmodule`), kept on purpose | `npm i convertapi-js` |
-| `module` | stable releases from `main` (the ES module line, `1.1.x`) | `npm i convertapi-js@~1.1` (as the README says) |
+| `latest` | stable releases from `main` (the ES module line, `1.1.x`) | `npm i convertapi-js`, or `npm i convertapi-js@~1.1` as the README says |
 | `next` | pre-releases | `npm i convertapi-js@next` |
-| `maintenance` | a stable version lower than the current `module` one | `npm i convertapi-js@maintenance` |
+| `maintenance` | a stable version lower than the current `latest` one | `npm i convertapi-js@maintenance` |
+| `module` | `1.1.11`, no longer moved: stable releases up to 1.1.11 were published here | `npm i convertapi-js@module` |
 
-A release never moves `latest`. Moving it to the module line changes what `npm i convertapi-js` and
-unversioned CDN URLs (for example https://cdn.jsdelivr.net/npm/convertapi-js) serve, which breaks pages
-that load the non-module build with a script tag, so it is a separate decision:
-`npm dist-tag add convertapi-js@1.1.10 latest`.
+Until 2026-11-12, `latest` was kept on `1.0.8`, the last **non-module** build (git tag `last_nonmodule`), so
+that pages loading it with an unversioned script tag kept working. On that day it was moved to `1.1.11` with
+`npm dist-tag add convertapi-js@1.1.11 latest`. Now that `latest` is the ES module line,
+unversioned CDN URLs (for example https://unpkg.com/convertapi-js/lib/convertapi.js or
+https://cdn.jsdelivr.net/npm/convertapi-js) resolve to a version that has no `lib/` and is not a classic
+script, so a page that still uses the non-module build must pin it:
+
+```html
+<script src="https://unpkg.com/convertapi-js@1.0.8/lib/convertapi.js"></script>
+```
 
 **Pre-releases** work the same way and may come from any branch: