EnumerateVersions should have a parameter for whether or not pre-release versions get counted.

When I think about "latest", I think about "what would npm install foo do?"

But for npm, this really means "whatever is tagged latest", which is defined under dist-tags in the registry. Other package managers could of course do it differently. I suppose we could use that for registries that provide it, and if not, sort by semver, and if ambiguous, sort by time?

I agree, and think the behavior should try to match the default behavior of the original package manager tool.

In general, even if the manager api we use doesn't set a prerelease flag, if it's set by semver (having a - flag in the version) that shouldn't come up as latest.

Maybe this API needs a bool flag to accept/not accept prereleases?

Originally posted by @gfs in https://github.com/microsoft/OSSGadget/issues/314#issuecomment-1071259406

Start by locating the EnumerateVersions API and its callers or tests in the OSSGadget repository. Review how versions are ordered and how package-manager defaults are represented; done means callers can choose whether semver prerelease versions are counted without changing the intended default behavior.