Restrict latest versions to stable releases only for maven repositories

Signed-off-by: Walter de Boer <[email protected]>
DependencyTrack · Feb 17, 2023 · 22791bf · 22791bf
1 parent 30b548c
commit 22791bf
Showing 1 changed file with 10 additions and 5 deletions.
diff --git a/src/main/java/org/dependencytrack/tasks/repositories/MavenMetaAnalyzer.java b/src/main/java/org/dependencytrack/tasks/repositories/MavenMetaAnalyzer.java
@@ -137,13 +137,13 @@ public MetaModel analyze(final Component component) {
                                 // No need to determine stableLatest as it wil always be null or release:
                                 // final String stableLatest = !latest.matches(UNSTABLE_VERSIONS_PATTERN) ? null : latest;
 
-                                //WdB
+                                final XPathExpression lastUpdatedExpression = xpath.compile("/metadata/versioning/lastUpdated");
+                                final String lastUpdated = (String) lastUpdatedExpression.evaluate(document, XPathConstants.STRING);
+
                                 if (stableRelease != null) {
                                     meta.setLatestVersion(stableRelease);
-                                    final XPathExpression lastUpdatedExpression = xpath.compile("/metadata/versioning/lastUpdated");
-                                    final String lastUpdated = (String) lastUpdatedExpression.evaluate(document, XPathConstants.STRING);                                    
                                     if (lastUpdated != null && stableRelease.equals(latest)) {
-                                        // lastUpdated reflects the timestamp when latest was updated, so it's only valid for release when stableRelease == latest
+                                        // lastUpdated reflects the timestamp when latest was updated, so it's only valid when stableRelease == latest
                                         meta.setPublishedTimestamp(DateUtil.parseDate(lastUpdated));
                                     }
                                 } else {
@@ -168,7 +168,12 @@ public MetaModel analyze(final Component component) {
                                         latestStableVersion = stableVersions.stream().reduce(null, (highest, current) -> highestVersion(highest, current));
                                     }
                                     // use latestStableVersion, or else latest unstable release (e.g. alpha, milestone) or else latest snapshot
-                                    meta.setLatestVersion(latestStableVersion != null ? latestStableVersion: (release != null ? release: latest));
+                                    String latestVersion = latestStableVersion != null ? latestStableVersion: (release != null ? release: latest);
+                                    meta.setLatestVersion(latestVersion);                                                                       
+                                    if (lastUpdated != null && latestVersion.equals(latest)) {
+                                        // lastUpdated reflects the timestamp when latest was updated, so it's only valid when latestVersion == latest
+                                        meta.setPublishedTimestamp(DateUtil.parseDate(lastUpdated));
+                                    }
                                 }
                             }
                         }