npm packages are published with the latest dist-tag even when released from a maintenance branch

Issue

Maintenance branches are publishing their packages on https://www.npmjs.com/ as latest

Expected

latest always points to the newest released version, and never to a release candidate or a maintenance release