Decide and document how we release fixes for earlier major versions

[hannalaakso]

What

Split from #1958.

We currently haven't decided or documented how we would issue a patch fix for an earlier major version.

This is both a product issue (how far back in time does our backwards compatibility go?) and a technical one.

An example scenario would be if we discovered a serious bug in GOV.UK Frontend 3.x.x after we release v4.0.

Why

It would be good contingency to decide (and document if appropriate) how we should handle a scenario like the one above.

Further detail

We think we have documented how we think we would handle this from a technical point of view but a question around handling the latest npm tag remains (see below),

Done when

• We've discussed with the product owner how we want to solve this problem- the browser support work has forced our hand on this a bit as we'll need to maintain v4 and v5+
• If necessary, we've investigated and decided how we avoid moving the latest tag on npm
• If necessary, we've created docs for the process of releasing a fix for an earlier major version

[vanitabarrett]

We have an approach for doing a release when there are unreleasable changes on main. We should test if the same approach works for publishing a release for a previous major version, as we'll need to do that when we release v5 and drop IE support.

I think the biggest question we've thought of is how we avoid moving the latest tag on npm (e.g: we don't want v4.2.0 to show up as the latest release if v5 is already out)

[lfdebrux]

I think the biggest question we've thought of is how we avoid moving the latest tag on npm (e.g: we don't want v4.2.0 to show up as the latest release if v5 is already out)

This is fairly straightforward to do, npm publish accepts a --tag argument [1] that lets you specify a tag other than latest.

There does need to be a tag [2], and there isn't any documented convention on what the tag should be if not latest [3], but npm themselves use the pattern latest-<major version> [4], which makes sense to me.

We'd need to modify the publish-release script to allow overriding the tag, but we might be able to add logic to generate the tag for the dev, from the major version.

[vanitabarrett]

Thanks @lfdebrux , I've come to the same conclusion and I've been looking at how we might tweak our publish-release script to add this 👍