[BUG] Latest tag version on NPM is incorrect

[xfournet]

What is the bug?

'latest' version on NPM is 1.2.0 while version 2.x are existing too

How can one reproduce the bug?

npm i @opensearch-project/opensearch
grep @opensearch-project/opensearch package.json

Output "@opensearch-project/opensearch": "^1.2.0"

What is the expected behavior?

Latest version is the 2.2.1

What is your host/environment?

Windows

Do you have any screenshots?

Do you have any additional context?

No

[dblock]

Looks like we need to npm-dist-tag as well in the release.

[sam-goodwin]

Can we get this fixed ASAP? It's a minor change and it cost me a ton of time and confusion. Small fix to something that drastically hurts the experience.

#522

[dblock]

@sam-goodwin Help make the code change where we need to be doing this? The job that runs the release has access to credentials but the humans here don't. Let's ask @gaiksaya to help us tag the previous release too, but I want to make sure we have it fixed moving forward.

[sam-goodwin]

I am not sure - I think you need to run dist-tag CLI and AFAIK, updating the latest is default behavior.

[dblock]

I found where we do the publication and opened an issue in opensearch-project/opensearch-build-libraries#206. Please feel free to take it on.

[gaiksaya]

Hi @sam-goodwin ,

Thanks for bringing this to our attention. I do not see a way to "NOT" tag anything as latest as this is the default behavior of npmjs. Re-tagging the same version as latest for every release might be possible.
What do you think about solution suggested in this post https://stackoverflow.com/questions/68230173/publishing-a-previous-major-version-to-npm-with-no-tag-and-avoiding-latest
We are following the same approach for all our docker images.
Example: https://hub.docker.com/r/opensearchproject/opensearch/tags
1 -> Latest version of 1.x series
2 -> Lastest version of 2.x series

[dblock]

Oh so the fact that we publish both 1.x and 2.x lines is what's causing this. Agree that we should remove latest and do @v1 @v2 in that case.

[gaiksaya]

@dblock I think you misunderstood, we cannot "remove" latest anyway. What we can do it keep retagging the latest release along with other releases. This is optional.
However in order to avoid problems like mentioned by @sam-goodwin, users can pull major version latest and not depend on latest tagged by npm by default.

[dblock]

I see. So can nothing be done or should we do something?