Publish stable releases under the npm dist-tag latest - #33

Why

npm view convertapi-js dist-tags shows latest: 1.0.8, module: 1.1.11 and debug: 1.1.9-debug.3.

Since 2022-06-21 the ES module line (1.1.x) has gone to the dist-tag module. latest was kept on 1.0.8,
the last non-module build (git tag last_nonmodule), on purpose. That kept pages working that load the
build with an unversioned script tag, https://unpkg.com/convertapi-js/lib/convertapi.js, which is the URL
the README gave before 2022. publish.yml (STABLE_DIST_TAG: module) and RELEASING.md kept that rule.

What it costs today:

• npm i convertapi-js is the install command on https://www.npmjs.com/package/convertapi-js, and it
  installs 1.0.8.
• 1.0.8 is a classic script: a global ConvertApi namespace with no exports, whose auth() takes
  {secret} or {apiKey, token}.
• The README, https://www.convertapi.com/integrations/libraries/javascript and the site's snippets use
  import ConvertApi from 'convertapi-js' and ConvertApi.auth('api_token'). Neither works on 1.0.8:
  • the package has no default export;
  • a string credential is sent as token=undefined, and the API answers 401.
• The npm package page shows "1.0.8 - Published 4 years ago" with the 2022 README
  (ConvertApi.auth({secret: ...})), instead of 1.1.11 with provenance.
• npm i convertapi-js writes "^1.0.8" into package.json. GitHub code search returns 100 package.json
  files that list convertapi-js; 39 of them use that range.
• npm downloads in the last 7 days: 1.0.8: 2459, 1.1.9: 1493, 1.1.8: 274, 1.1.11: 174.

What changes

• publish.yml: STABLE_DIST_TAG: latest, so a stable release from main takes latest. Nothing else
  changes:
  • pre-releases still go to next;
  • a stable version lower than the current latest still goes to maintenance.
• RELEASING.md, CHANGELOG.md and README.md:
  • the dist-tag table and its history;
  • module stays on 1.1.11 and is no longer moved;
  • pages that still load the non-module build pin it:
    <script src="https://unpkg.com/convertapi-js@1.0.8/lib/convertapi.js"></script>.
• CHANGELOG.md calls the last release 1.1.11. The v1.1.10 Release never reached npm, because its publish
  failed (fixed in Publish the tarball by a ./ path #28).
• The release examples use v1.1.12, because v1.1.10 and v1.1.11 already exist.

Who this breaks, and when

latest was moved to 1.1.11 on 2026-11-12 with npm dist-tag add convertapi-js@1.1.11 latest, so the
effects below have started. This PR makes the next stable release keep latest (without it, the release
would go to module and latest would stay on 1.1.11). Rollback: npm dist-tag add convertapi-js@1.0.8 latest.

Since the move:

• Unversioned script tags. These URLs serve 1.1.x when no version is given:

  • https://unpkg.com/convertapi-js/lib/convertapi.js and
    https://cdn.jsdelivr.net/npm/convertapi-js/lib/convertapi.js return 404, because 1.1.x has no lib/;
  • https://cdn.jsdelivr.net/npm/convertapi-js, loaded as a classic script, fails on import.

  Pinning @1.0.8 fixes them. In the last 30 days jsDelivr served 1.0.8's /lib/convertapi.js 343 times,
  pinned and unversioned URLs counted together; unpkg publishes no numbers.

• ^1.0.8 ranges. A project with "convertapi-js": "^1.0.8" gets 1.1.x if it installs without a
  lockfile or runs npm update, because npm prefers the latest version when it satisfies the range.
  Lockfiles keep 1.0.8.

• @module. npm i convertapi-js@module still installs 1.1.11.

A blog post on convertapi.com, https://www.convertapi.com/blog/create-online-pdf-converter-using-js, loads
the unversioned unpkg URL. It needs its own fix on the site; its example already fails on 1.0.8, because it
calls ConvertApi.auth('api_token').

Checks

• publish.yml parses as YAML. The only functional change is the STABLE_DIST_TAG value.
• publish.yml cannot run in a pull request. It next runs on the next GitHub Release.
• The build check covers the rest of the repository.

CHANGELOG.md and RELEASING.md record the date of the move.

🤖 Generated with Claude Code