react-router-dom-v5-compat NPM latest tag not updated

[MattIPv4]

Reproduction

https://www.npmjs.com/package/react-router-dom-v5-compat?activeTab=versions

6.30.0 is marked as latest rather than 6.30.3

System Info

N/A

Used Package Manager

npm

Expected Behavior

6.30.3 should be marked as latest

Actual Behavior

6.30.0 is be marked as latest

[timdorr]

There have been to actual changes to this package for 2 years: https://github.com/remix-run/react-router/tree/v6/packages/react-router-dom-v5-compat

This doesn't have any effect on the operation of the library, so it's fine if it lags behind a bit.

[MattIPv4]

👀 I disagree there, there are changes, they just don't show in the directory history... the package has a direct dependency of "react-router": "workspace:*", so if you currently install react-router-dom-v5-compat@latest you get react-router@6.30.0 which contains a CVE... Same goes for @remix-run/router which is installed as @remix-run/router@1.23.0 which also contains a CVE...

Please make sure the latest tag gets updated.

[MattIPv4]

👋 @timdorr checking in here again, it looks like version-6 is correct, but not latest still... so any install of a package that has a transitive dependency on react-router-dom-v5-compat will end up installing a vulnerable version...

[brophdawg11]

This is an unintended bug in our usage of the changesets tool since it doesn't allow us to specify different tags per-package when publishing from a monorepo. We caught and fixed this recently for @remix-run/router (which doesn't have a v7 equivalent), but missed react-router-dom-v5-compat (and prbably react-router-native too) which don't have v7 equivalents. We'll update the tag for now and will need to make some adjustments to our release process to make sure that packages that didn't continue on into v7 still get latest on new publishes in the 6.x range.

[MattIPv4]

Much appreciated, thank you!