diff --git a/src/main/java/org/dependencytrack/tasks/repositories/MavenMetaAnalyzer.java b/src/main/java/org/dependencytrack/tasks/repositories/MavenMetaAnalyzer.java index f275066468..304671a819 100644 --- a/src/main/java/org/dependencytrack/tasks/repositories/MavenMetaAnalyzer.java +++ b/src/main/java/org/dependencytrack/tasks/repositories/MavenMetaAnalyzer.java @@ -137,13 +137,13 @@ public MetaModel analyze(final Component component) { // No need to determine stableLatest as it wil always be null or release: // final String stableLatest = !latest.matches(UNSTABLE_VERSIONS_PATTERN) ? null : latest; - //WdB + final XPathExpression lastUpdatedExpression = xpath.compile("/metadata/versioning/lastUpdated"); + final String lastUpdated = (String) lastUpdatedExpression.evaluate(document, XPathConstants.STRING); + if (stableRelease != null) { meta.setLatestVersion(stableRelease); - final XPathExpression lastUpdatedExpression = xpath.compile("/metadata/versioning/lastUpdated"); - final String lastUpdated = (String) lastUpdatedExpression.evaluate(document, XPathConstants.STRING); if (lastUpdated != null && stableRelease.equals(latest)) { - // lastUpdated reflects the timestamp when latest was updated, so it's only valid for release when stableRelease == latest + // lastUpdated reflects the timestamp when latest was updated, so it's only valid when stableRelease == latest meta.setPublishedTimestamp(DateUtil.parseDate(lastUpdated)); } } else { @@ -168,7 +168,12 @@ public MetaModel analyze(final Component component) { latestStableVersion = stableVersions.stream().reduce(null, (highest, current) -> highestVersion(highest, current)); } // use latestStableVersion, or else latest unstable release (e.g. alpha, milestone) or else latest snapshot - meta.setLatestVersion(latestStableVersion != null ? latestStableVersion: (release != null ? release: latest)); + String latestVersion = latestStableVersion != null ? latestStableVersion: (release != null ? release: latest); + meta.setLatestVersion(latestVersion); + if (lastUpdated != null && latestVersion.equals(latest)) { + // lastUpdated reflects the timestamp when latest was updated, so it's only valid when latestVersion == latest + meta.setPublishedTimestamp(DateUtil.parseDate(lastUpdated)); + } } } }