DependencyTrack / DependencyTrack/dependency-track

Restrict latest versions to stable releases only for all default repositories

Open
#2,500 0 comments 4 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior:

The latest version found in the Maven metadata might be a beta, milestone, snapshot or any other unstable releases. Only stable releases should be considderd though when looking for outdated components. Also the latest version is not always the highest version, since most repositories report the last published date of any version, instead of the highest version.

Cargo and Go report highest stable versions. In NPM the latest version might also not be the highest version, though it should be a stable release. For others unstable versions might be reported.

![image](https://user-images.githubusercontent.com/11032733/225838229-7dad30a8-82a2-4ec4-adf4-9dcd61879003.png)

### Proposed Behavior

Only report highest stable versions when determining the latest versions. Stable versions can be determined by parsing the version numbers and looking for known labels like alpha, beta, rc, snapshot, etc. When no stable version exists, the highest unstable version should be reported.

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.