DependencyTrack / DependencyTrack/dependency-track
Restrict latest versions to stable releases only for all default repositories
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior:
The latest version found in the Maven metadata might be a beta, milestone, snapshot or any other unstable releases. Only stable releases should be considderd though when looking for outdated components. Also the latest version is not always the highest version, since most repositories report the last published date of any version, instead of the highest version.
Cargo and Go report highest stable versions. In NPM the latest version might also not be the highest version, though it should be a stable release. For others unstable versions might be reported.

### Proposed Behavior
Only report highest stable versions when determining the latest versions. Stable versions can be determined by parsing the version numbers and looking for known labels like alpha, beta, rc, snapshot, etc. When no stable version exists, the highest unstable version should be reported.
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested
Contributor guide
Assessment
This issue has not been assessed yet.