NuGet stable vs preview version vulnerabilities

### Current Behavior:

It reports vulnerabilities for not being in the latest preview version.

### Proposed Behavior:

It should not suggest preview versions, it should only compare against stable versions.

Or if you don't want to change the behavior at least the possibility that it can be configured.

Relevant code:

https://github.com/DependencyTrack/dependency-track/blob/master/src/main/java/org/dependencytrack/tasks/repositories/NugetMetaAnalyzer.java#L108

Edit:

It seems that there is no way to filter the prerelease attribute on the endpoint being used.

Docs:

https://docs.microsoft.com/en-us/nuget/api/package-base-address-resource

Example:

https://api.nuget.org/v3-flatcontainer/system.text.json/index.json

BUT:

I see that it is possible with another logic and another type of requests.

1. Making a request to:

https://api.nuget.org/v3/registration5-gz-semver2/system.text.json/index.json

Searching for "catalogEntry > id"


Resulting url:

https://api.nuget.org/v3/catalog0/data/2022.06.14.13.40.27/system.text.json.7.0.0-preview.5.22301.12.json


This one does have the "isPrerelease" attribute.

### **If there is no better way, refactoring would be:**

1. Call to: https://api.nuget.org/v3/registration5-gz-semver2/{package-id/index.json

2. Make a request to the url of each item from newest to oldest until it finds the first one with "isPrerelease: false".