diff --git a/docs/_docs/analysis-types/outdated-components.md b/docs/_docs/analysis-types/outdated-components.md
index 8ede02b49b..1077126239 100644
--- a/docs/_docs/analysis-types/outdated-components.md
+++ b/docs/_docs/analysis-types/outdated-components.md
@@ -27,3 +27,9 @@ from various repositories. Dependency-Track relies on Package URL (PURL) to iden
 to, the metadata about the component, and uses that data to query the various repositories capable of supporting the 
 components ecosystem. Refer to [Repositories]({{ site.baseurl }}{% link _docs/datasources/repositories.md %}) for 
 further information.
+
+### Stable releases
+In some repositories, for example NPM, the latest release should always denote a stable release. In others, such as Maven, the latest version might be a stable release or an unstable version. In NPM as well as Maven repositories, the latest version does not need to be the highest version. It's just the latest published to the repository.
+
+For some repositories, Dependency-Track tries to find the highest stable release instead of just the latest version. Refer to [Repositories]({{ site.baseurl }}{% link _docs/datasources/repositories.md %}) for further information.
+
diff --git a/docs/_docs/datasources/repositories.md b/docs/_docs/datasources/repositories.md
index 5ecc964c3d..fe1a887b34 100644
--- a/docs/_docs/datasources/repositories.md
+++ b/docs/_docs/datasources/repositories.md
@@ -59,3 +59,17 @@ leveraging repositories to identify outdated components.
 
 Refer to [Datasource Routing]({{ site.baseurl }}{% link _docs/datasources/routing.md %})
 for information on Package URL and the various ways it is used throughout Dependency-Track.
+
+#### Highest stable release
+Dependency-Track identifies outdated components by looking for newer versions of the component. Preferably this should be a higher version, but usualy repositories report the newest version of a component which might not be the highest version. Also some repositories report unstable versions as the latest version.
+
+Dependency-Track tries find the highest stable release by parsing the list of versions and ignoring labels like alpha, beta, or snapshot. When no stable release exists, the highest unstable version is reported. This feature is suported for all default repositories:
+  * Cargo
+  * Composer
+  * Gem
+  * Go
+  * Hex
+  * Maven
+  * NPM
+  * NuGet
+  * PyPi
diff --git a/pom.xml b/pom.xml
index 374db4bcfd..3980f97cc6 100644
--- a/pom.xml
+++ b/pom.xml
@@ -227,6 +227,12 @@
             <artifactId>lucene-sandbox</artifactId>
             <version>${lib.lucene.version}</version>
         </dependency>
+        <!-- Semver4j-->
+        <dependency>
+            <groupId>com.vdurmont</groupId>
+            <artifactId>semver4j</artifactId>
+            <version>3.1.0</version>
+        </dependency>
         <!-- Pebble templating engine -->
         <dependency>
             <groupId>io.pebbletemplates</groupId>
diff --git a/src/main/java/org/dependencytrack/policy/VersionPolicyEvaluator.java b/src/main/java/org/dependencytrack/policy/VersionPolicyEvaluator.java
index 904063dff8..1ae81cb833 100644
--- a/src/main/java/org/dependencytrack/policy/VersionPolicyEvaluator.java
+++ b/src/main/java/org/dependencytrack/policy/VersionPolicyEvaluator.java
@@ -18,14 +18,13 @@
  */
 package org.dependencytrack.policy;
 
-import alpine.common.logging.Logger;
+import java.util.ArrayList;
+import java.util.List;
 import org.dependencytrack.model.Component;
 import org.dependencytrack.model.Policy;
 import org.dependencytrack.model.PolicyCondition;
 import org.dependencytrack.util.ComponentVersion;
-
-import java.util.ArrayList;
-import java.util.List;
+import alpine.common.logging.Logger;
 
 /**
  * Evaluates a components version against a policy.
@@ -56,10 +55,6 @@ public List<PolicyConditionViolation> evaluate(final Policy policy, final Compon
             LOGGER.debug("Evaluating component (" + component.getUuid() + ") against policy condition (" + condition.getUuid() + ")");
 
             final var conditionVersion = new ComponentVersion(condition.getValue());
-            if (conditionVersion.getVersionParts().isEmpty()) {
-                LOGGER.warn("Unable to parse version (" + condition.getValue() + " provided by condition");
-                continue;
-            }
 
             if (matches(componentVersion, conditionVersion, condition.getOperator())) {
                 violations.add(new PolicyConditionViolation(condition, component));
diff --git a/src/main/java/org/dependencytrack/tasks/repositories/AbstractMetaAnalyzer.java b/src/main/java/org/dependencytrack/tasks/repositories/AbstractMetaAnalyzer.java
index 5e0cee6ec2..5150749f76 100644
--- a/src/main/java/org/dependencytrack/tasks/repositories/AbstractMetaAnalyzer.java
+++ b/src/main/java/org/dependencytrack/tasks/repositories/AbstractMetaAnalyzer.java
@@ -18,23 +18,23 @@
  */
 package org.dependencytrack.tasks.repositories;
 
-import alpine.common.logging.Logger;
-import alpine.notification.Notification;
-import alpine.notification.NotificationLevel;
+import java.io.IOException;
+import java.net.URISyntaxException;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.http.client.methods.CloseableHttpResponse;
 import org.apache.http.client.methods.HttpGet;
 import org.apache.http.client.methods.HttpUriRequest;
 import org.apache.http.client.utils.URIBuilder;
+import org.apache.maven.artifact.versioning.ComparableVersion;
 import org.dependencytrack.common.HttpClientPool;
 import org.dependencytrack.model.Component;
 import org.dependencytrack.notification.NotificationConstants;
 import org.dependencytrack.notification.NotificationGroup;
 import org.dependencytrack.notification.NotificationScope;
 import org.dependencytrack.util.HttpUtil;
-
-import java.io.IOException;
-import java.net.URISyntaxException;
+import alpine.common.logging.Logger;
+import alpine.notification.Notification;
+import alpine.notification.NotificationLevel;
 
 /**
  * Base abstract class that all IMetaAnalyzer implementations should likely extend.
@@ -49,6 +49,7 @@ public abstract class AbstractMetaAnalyzer implements IMetaAnalyzer {
     protected String username;
 
     protected String password;
+
     /**
      * {@inheritDoc}
      */
@@ -108,4 +109,29 @@ protected CloseableHttpResponse processHttpRequest(String url) throws IOExceptio
         }
     }
 
+    /**
+     * Parse two version strings and return the one containing the highest version
+     *
+     * @param v1string first version to compare
+     * @param v2string second version to compare
+     * @return the highest of two versions as string value
+     */
+    public static String highestVersion(String v1string, String v2string) {
+        if (v1string == null) {
+            return v2string;
+        } else if (v2string == null) {
+            return v1string;
+        } else {
+            ComparableVersion v1 = new ComparableVersion(stripLeadingV(v1string));
+            ComparableVersion v2 = new ComparableVersion(stripLeadingV(v2string));
+            return v1.compareTo(v2) > 0 ? v1string : v2string;
+        }
+    }
+
+    protected static String stripLeadingV(String s) {
+        return s.startsWith("v")
+                ? s.substring(1)
+                : s;
+    }
+
 }
diff --git a/src/main/java/org/dependencytrack/tasks/repositories/CargoMetaAnalyzer.java b/src/main/java/org/dependencytrack/tasks/repositories/CargoMetaAnalyzer.java
index 2e30a5f650..c6056c3a3f 100644
--- a/src/main/java/org/dependencytrack/tasks/repositories/CargoMetaAnalyzer.java
+++ b/src/main/java/org/dependencytrack/tasks/repositories/CargoMetaAnalyzer.java
@@ -18,20 +18,19 @@
  */
 package org.dependencytrack.tasks.repositories;
 
-import alpine.common.logging.Logger;
-import com.github.packageurl.PackageURL;
-import org.dependencytrack.exception.MetaAnalyzerException;
-import org.json.JSONArray;
-import org.json.JSONObject;
+import java.io.IOException;
 import org.apache.http.HttpEntity;
 import org.apache.http.HttpStatus;
 import org.apache.http.client.methods.CloseableHttpResponse;
 import org.apache.http.util.EntityUtils;
+import org.dependencytrack.exception.MetaAnalyzerException;
 import org.dependencytrack.model.Component;
 import org.dependencytrack.model.RepositoryType;
 import org.dependencytrack.util.DateUtil;
-
-import java.io.IOException;
+import org.json.JSONArray;
+import org.json.JSONObject;
+import com.github.packageurl.PackageURL;
+import alpine.common.logging.Logger;
 
 /**
  * An IMetaAnalyzer implementation that supports Cargo via crates.io compatible repos
@@ -74,28 +73,11 @@ public MetaModel analyze(final Component component) {
                 if (response.getStatusLine().getStatusCode() == HttpStatus.SC_OK) {
                     final HttpEntity entity = response.getEntity();
                     if (entity != null) {
-                        String responseString = EntityUtils.toString(entity);
-                        var jsonObject = new JSONObject(responseString);
+                        final String responseString = EntityUtils.toString(entity);
+                        final JSONObject jsonObject = new JSONObject(responseString);
                         final JSONObject crate = jsonObject.optJSONObject("crate");
-                        if (crate != null) {
-                            final String latest = crate.getString("newest_version");
-                            meta.setLatestVersion(latest);
-                        }
                         final JSONArray versions = jsonObject.optJSONArray("versions");
-                        if (versions != null) {
-                            for (int i = 0; i < versions.length(); i++) {
-                                final JSONObject version = versions.getJSONObject(i);
-                                final String versionString = version.optString("num");
-                                if (meta.getLatestVersion() != null && meta.getLatestVersion().equals(versionString)) {
-                                    final String publishedTimestamp = version.optString("created_at");
-                                    try {
-                                        meta.setPublishedTimestamp(DateUtil.fromISO8601(publishedTimestamp));
-                                    } catch (IllegalArgumentException e) {
-                                        LOGGER.warn("An error occurred while parsing published time", e);
-                                    }
-                                }
-                            }
-                        }
+                        analyzeCrate(meta, crate, versions);
                     }
                 } else {
                     handleUnexpectedHttpResponse(LOGGER, url, response.getStatusLine().getStatusCode(), response.getStatusLine().getReasonPhrase(), component);
@@ -108,4 +90,26 @@ public MetaModel analyze(final Component component) {
         }
         return meta;
     }
+
+    private void analyzeCrate(final MetaModel meta, final JSONObject crate, final JSONArray versions) {
+        if (crate != null) {
+            // Cargo has a highest stable version: https://github.com/rust-lang/crates.io/pull/3163
+            final String latest = crate.getString("max_stable_version");
+            meta.setLatestVersion(latest);
+        }
+        if (versions != null) {
+            for (int i=0; i<versions.length(); i++) {
+                final JSONObject version =  versions.getJSONObject(i);
+                final String versionString = version.optString("num");
+                if (meta.getLatestVersion() != null && meta.getLatestVersion().equals(versionString)) {
+                    final String publishedTimestamp = version.optString("created_at");
+                    try {
+                        meta.setPublishedTimestamp(DateUtil.fromISO8601(publishedTimestamp));
+                    } catch (IllegalArgumentException  e) {
+                        LOGGER.warn("An error occurred while parsing published time", e);
+                    }
+                }
+            }
+        }
+    }
 }
diff --git a/src/main/java/org/dependencytrack/tasks/repositories/ComposerMetaAnalyzer.java b/src/main/java/org/dependencytrack/tasks/repositories/ComposerMetaAnalyzer.java
index 4d6a7a0eed..a084d548bd 100644
--- a/src/main/java/org/dependencytrack/tasks/repositories/ComposerMetaAnalyzer.java
+++ b/src/main/java/org/dependencytrack/tasks/repositories/ComposerMetaAnalyzer.java
@@ -18,21 +18,24 @@
  */
 package org.dependencytrack.tasks.repositories;
 
-import alpine.common.logging.Logger;
-import com.github.packageurl.PackageURL;
-import org.dependencytrack.exception.MetaAnalyzerException;
-import org.json.JSONObject;
+import java.io.IOException;
+import java.text.DateFormat;
+import java.text.ParseException;
+import java.text.SimpleDateFormat;
+import java.util.ArrayList;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.Map;
 import org.apache.http.HttpStatus;
 import org.apache.http.client.methods.CloseableHttpResponse;
 import org.apache.http.util.EntityUtils;
-import org.apache.maven.artifact.versioning.ComparableVersion;
+import org.dependencytrack.exception.MetaAnalyzerException;
 import org.dependencytrack.model.Component;
 import org.dependencytrack.model.RepositoryType;
-
-import java.io.IOException;
-import java.text.DateFormat;
-import java.text.ParseException;
-import java.text.SimpleDateFormat;
+import org.dependencytrack.util.ComponentVersion;
+import org.json.JSONObject;
+import com.github.packageurl.PackageURL;
+import alpine.common.logging.Logger;
 
 /**
  * An IMetaAnalyzer implementation that supports Composer.
@@ -103,34 +106,23 @@ public MetaModel analyze(final Component component) {
             }
             final JSONObject composerPackage = responsePackages.getJSONObject(expectedResponsePackage);
 
-            final ComparableVersion latestVersion = new ComparableVersion(stripLeadingV(component.getPurl().getVersion()));
-            final DateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ssXXX");
-
-            composerPackage.names().forEach(key_ -> {
-                String key = (String) key_;
-                if (key.startsWith("dev-") || key.endsWith("-dev")) {
+            // get list of versions and published timestamps
+            Map<String, String> versions = new HashMap<>();
+            composerPackage.names().forEach(keyObject -> {
+                String key = (String) keyObject;
+                if (!key.startsWith("dev-") && !key.endsWith("-dev")) {
                     // dev versions are excluded, since they are not pinned but a VCS-branch.
-                    return;
-                }
-
-                final String version_normalized = composerPackage.getJSONObject(key).getString("version_normalized");
-                ComparableVersion currentComparableVersion = new ComparableVersion(version_normalized);
-                if (currentComparableVersion.compareTo(latestVersion) < 0) {
-                    // smaller version can be skipped
-                    return;
+                    final String version = composerPackage.getJSONObject(key).getString("version");
+                    final String published = composerPackage.getJSONObject(key).getString("time");
+                    versions.put(version, published);
                 }
+            });
+            final String highestVersion = ComponentVersion.findHighestVersion(new ArrayList<>(versions.keySet()));
+            meta.setLatestVersion(highestVersion);
 
-                final String version = composerPackage.getJSONObject(key).getString("version");
-                latestVersion.parseVersion(stripLeadingV(version_normalized));
-                meta.setLatestVersion(version);
+            final String published = versions.get(highestVersion);
+            meta.setPublishedTimestamp(getPublisedTimestamp(published));
 
-                final String published = composerPackage.getJSONObject(key).getString("time");
-                try {
-                    meta.setPublishedTimestamp(dateFormat.parse(published));
-                } catch (ParseException e) {
-                    LOGGER.warn("An error occurred while parsing upload time", e);
-                }
-            });
         } catch (IOException ex) {
             handleRequestException(LOGGER, ex);
         } catch (Exception ex) {
@@ -140,9 +132,15 @@ public MetaModel analyze(final Component component) {
         return meta;
     }
 
-    private static String stripLeadingV(String s) {
-        return s.startsWith("v")
-                ? s.substring(1)
-                : s;
+    private Date getPublisedTimestamp(final String published) {
+        Date publishedTimestamp = null;
+        try {
+            final DateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ssXXX");
+            publishedTimestamp = dateFormat.parse(published);
+        } catch (ParseException e) {
+            LOGGER.warn("An error occurred while parsing upload time", e);
+        }
+        return publishedTimestamp;
     }
+
 }
diff --git a/src/main/java/org/dependencytrack/tasks/repositories/GemMetaAnalyzer.java b/src/main/java/org/dependencytrack/tasks/repositories/GemMetaAnalyzer.java
index 375d06a340..a4f37131cf 100644
--- a/src/main/java/org/dependencytrack/tasks/repositories/GemMetaAnalyzer.java
+++ b/src/main/java/org/dependencytrack/tasks/repositories/GemMetaAnalyzer.java
@@ -18,17 +18,25 @@
  */
 package org.dependencytrack.tasks.repositories;
 
-import alpine.common.logging.Logger;
-import com.github.packageurl.PackageURL;
+import java.io.IOException;
+import java.text.DateFormat;
+import java.text.ParseException;
+import java.text.SimpleDateFormat;
+import java.util.ArrayList;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.Map;
 import org.apache.http.HttpStatus;
 import org.apache.http.client.methods.CloseableHttpResponse;
 import org.apache.http.util.EntityUtils;
 import org.dependencytrack.exception.MetaAnalyzerException;
 import org.dependencytrack.model.Component;
 import org.dependencytrack.model.RepositoryType;
+import org.dependencytrack.util.ComponentVersion;
+import org.json.JSONArray;
 import org.json.JSONObject;
-
-import java.io.IOException;
+import com.github.packageurl.PackageURL;
+import alpine.common.logging.Logger;
 
 /**
  * An IMetaAnalyzer implementation that supports Ruby Gems.
@@ -40,7 +48,7 @@ public class GemMetaAnalyzer extends AbstractMetaAnalyzer {
 
     private static final Logger LOGGER = Logger.getLogger(GemMetaAnalyzer.class);
     private static final String DEFAULT_BASE_URL = "https://rubygems.org";
-    private static final String API_URL = "/api/v1/versions/%s/latest.json";
+    private static final String API_URL = "/api/v1/versions/%s.json";
 
     GemMetaAnalyzer() {
         this.baseUrl = DEFAULT_BASE_URL;
@@ -71,9 +79,8 @@ public MetaModel analyze(final Component component) {
                 if (response.getStatusLine().getStatusCode() == HttpStatus.SC_OK){
                     if(response.getEntity()!=null){
                         String responseString = EntityUtils.toString(response.getEntity());
-                        var jsonObject = new JSONObject(responseString);
-                        final String latest = jsonObject.getString("version");
-                        meta.setLatestVersion(latest);
+                        var releasesArray = new JSONArray(responseString);
+                        analyzeReleases(meta, releasesArray);
                     }
                 } else {
                     handleUnexpectedHttpResponse(LOGGER, url, response.getStatusLine().getStatusCode(), response.getStatusLine().getReasonPhrase(), component);
@@ -87,4 +94,30 @@ public MetaModel analyze(final Component component) {
         }
         return meta;
     }
+
+    private void analyzeReleases(final MetaModel meta, final JSONArray releasesArray) {
+        Map<String, String> versions = new HashMap<>();
+        for (int i = 0; i<releasesArray.length(); i++) {
+            JSONObject release = releasesArray.getJSONObject(i);
+            final String version = release.optString("number", null);
+            final String createdAt = release.optString("created_at", null);
+            versions.put(version, createdAt);
+        }
+        final String highestVersion = ComponentVersion.findHighestVersion(new ArrayList<>(versions.keySet()));
+        meta.setLatestVersion(highestVersion);
+
+        final String createdAt = versions.get(highestVersion);
+        meta.setPublishedTimestamp(getPublishedTimestamp(createdAt));
+    }
+
+    private Date getPublishedTimestamp(final String insertedAt) {
+        final DateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'");
+        Date publishedTimestamp = null;
+        try {
+            publishedTimestamp = dateFormat.parse(insertedAt);
+        } catch (ParseException e) {
+            LOGGER.warn("An error occurred while parsing published time", e);
+        }
+        return publishedTimestamp;
+    }
 }
diff --git a/src/main/java/org/dependencytrack/tasks/repositories/GoModulesMetaAnalyzer.java b/src/main/java/org/dependencytrack/tasks/repositories/GoModulesMetaAnalyzer.java
index e237e6cb40..d2481a25c6 100644
--- a/src/main/java/org/dependencytrack/tasks/repositories/GoModulesMetaAnalyzer.java
+++ b/src/main/java/org/dependencytrack/tasks/repositories/GoModulesMetaAnalyzer.java
@@ -18,8 +18,10 @@
  */
 package org.dependencytrack.tasks.repositories;
 
-import alpine.common.logging.Logger;
-import com.github.packageurl.PackageURL;
+import java.io.IOException;
+import java.text.ParseException;
+import java.text.SimpleDateFormat;
+
 import org.apache.commons.lang3.StringUtils;
 import org.apache.http.HttpStatus;
 import org.apache.http.client.methods.CloseableHttpResponse;
@@ -29,9 +31,9 @@
 import org.dependencytrack.model.RepositoryType;
 import org.json.JSONObject;
 
-import java.io.IOException;
-import java.text.ParseException;
-import java.text.SimpleDateFormat;
+import com.github.packageurl.PackageURL;
+
+import alpine.common.logging.Logger;
 
 /**
  * @see <a href="https://golang.org/ref/mod#goproxy-protocol">GOPROXY protocol</a>
@@ -41,7 +43,7 @@ public class GoModulesMetaAnalyzer extends AbstractMetaAnalyzer {
 
     private static final Logger LOGGER = Logger.getLogger(GoModulesMetaAnalyzer.class);
     private static final String DEFAULT_BASE_URL = "https://proxy.golang.org";
-    private static final String API_URL = "/%s/%s/@latest";
+    private static final String API_URL = "/%s/%s/@latest"; // latest selects the highest available release version
 
     GoModulesMetaAnalyzer() {
         this.baseUrl = DEFAULT_BASE_URL;
@@ -69,24 +71,9 @@ public MetaModel analyze(final Component component) {
         try (final CloseableHttpResponse response = processHttpRequest(url)) {
             if (response.getStatusLine().getStatusCode() == HttpStatus.SC_OK) {
                 if (response.getEntity()!=null) {
-                    String responseString = EntityUtils.toString(response.getEntity());
-                    final var responseJson = new JSONObject(responseString);
-                    meta.setLatestVersion(responseJson.getString("Version"));
-
-                    // Module versions are prefixed with "v" in the Go ecosystem.
-                    // Because some services (like OSS Index as of July 2021) do not support
-                    // versions with this prefix, components in DT may not be prefixed either.
-                    //
-                    // In order to make the versions comparable still, we strip the "v" prefix as well,
-                    // if it was done for the analyzed component.
-                    if (component.getVersion() != null && !component.getVersion().startsWith("v")) {
-                        meta.setLatestVersion(StringUtils.stripStart(meta.getLatestVersion(), "v"));
-                    }
-
-                    final String commitTimestamp = responseJson.getString("Time");
-                    if (StringUtils.isNotBlank(commitTimestamp)) { // Time is optional
-                        meta.setPublishedTimestamp(new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss'Z'").parse(commitTimestamp));
-                    }
+                    final String responseString = EntityUtils.toString(response.getEntity());
+                    final JSONObject responseJson = new JSONObject(responseString);
+                    analyzeResponse(component, meta, responseJson);
                 }
             } else {
                 handleUnexpectedHttpResponse(LOGGER, url, response.getStatusLine().getStatusCode(), response.getStatusLine().getReasonPhrase(), component);
@@ -100,6 +87,26 @@ public MetaModel analyze(final Component component) {
         return meta;
     }
 
+    private void analyzeResponse(final Component component, final MetaModel meta, final JSONObject responseJson)
+            throws ParseException {
+        meta.setLatestVersion(responseJson.getString("Version"));
+
+        // Module versions are prefixed with "v" in the Go ecosystem.
+        // Because some services (like OSS Index as of July 2021) do not support
+        // versions with this prefix, components in DT may not be prefixed either.
+        //
+        // In order to make the versions comparable still, we strip the "v" prefix as well,
+        // if it was done for the analyzed component.
+        if (component.getVersion() != null && !component.getVersion().startsWith("v")) {
+            meta.setLatestVersion(StringUtils.stripStart(meta.getLatestVersion(), "v"));
+        }
+
+        final String commitTimestamp = responseJson.getString("Time");
+        if (StringUtils.isNotBlank(commitTimestamp)) { // Time is optional
+            meta.setPublishedTimestamp(new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss'Z'").parse(commitTimestamp));
+        }
+    }
+
     /**
      * "To avoid ambiguity when serving from case-insensitive file systems, the $module [...] elements are
      * case-encoded by replacing every uppercase letter with an exclamation mark followed by the corresponding
diff --git a/src/main/java/org/dependencytrack/tasks/repositories/HexMetaAnalyzer.java b/src/main/java/org/dependencytrack/tasks/repositories/HexMetaAnalyzer.java
index 942e78cc65..1726cb76f2 100644
--- a/src/main/java/org/dependencytrack/tasks/repositories/HexMetaAnalyzer.java
+++ b/src/main/java/org/dependencytrack/tasks/repositories/HexMetaAnalyzer.java
@@ -18,22 +18,25 @@
  */
 package org.dependencytrack.tasks.repositories;
 
-import alpine.common.logging.Logger;
-import com.github.packageurl.PackageURL;
+import java.io.IOException;
+import java.text.DateFormat;
+import java.text.ParseException;
+import java.text.SimpleDateFormat;
+import java.util.ArrayList;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.Map;
 import org.apache.http.HttpStatus;
 import org.apache.http.client.methods.CloseableHttpResponse;
 import org.apache.http.util.EntityUtils;
 import org.dependencytrack.exception.MetaAnalyzerException;
 import org.dependencytrack.model.Component;
 import org.dependencytrack.model.RepositoryType;
+import org.dependencytrack.util.ComponentVersion;
 import org.json.JSONArray;
 import org.json.JSONObject;
-
-import java.io.IOException;
-import java.text.DateFormat;
-import java.text.ParseException;
-import java.text.SimpleDateFormat;
-import java.util.Date;
+import com.github.packageurl.PackageURL;
+import alpine.common.logging.Logger;
 
 /**
  * An IMetaAnalyzer implementation that supports Hex.
@@ -72,12 +75,7 @@ public MetaModel analyze(final Component component) {
         final MetaModel meta = new MetaModel(component);
         if (component.getPurl() != null) {
 
-            final String packageName;
-            if (component.getPurl().getNamespace() != null) {
-                packageName = component.getPurl().getNamespace().replace("@", "%40") + "%2F" + component.getPurl().getName();
-            } else {
-                packageName = component.getPurl().getName();
-            }
+            final String packageName = getPackageName(component.getPurl());
 
             final String url = String.format(baseUrl + API_URL, packageName);
             try (final CloseableHttpResponse response = processHttpRequest(url)) {
@@ -85,23 +83,8 @@ public MetaModel analyze(final Component component) {
                     if (response.getEntity()!=null) {
                         String responseString = EntityUtils.toString(response.getEntity());
                         var jsonObject = new JSONObject(responseString);
-                        final JSONArray releasesArray = jsonObject.getJSONArray("releases");
-                        if (releasesArray.length() > 0) {
-                            // The first one in the array is always the latest version
-                            final JSONObject release = releasesArray.getJSONObject(0);
-                            final String latest = release.optString("version", null);
-                            meta.setLatestVersion(latest);
-                            final String insertedAt = release.optString("inserted_at", null);
-                            if (insertedAt != null) {
-                                final DateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss");
-                                try {
-                                    final Date published = dateFormat.parse(insertedAt);
-                                    meta.setPublishedTimestamp(published);
-                                } catch (ParseException e) {
-                                    LOGGER.warn("An error occurred while parsing published time", e);
-                                }
-                            }
-                        }
+                        var releasesArray = jsonObject.getJSONArray("releases");
+                        analyzeReleases(meta, releasesArray);
                     }
                 } else {
                     handleUnexpectedHttpResponse(LOGGER, url, response.getStatusLine().getStatusCode(), response.getStatusLine().getReasonPhrase(), component);
@@ -115,4 +98,39 @@ public MetaModel analyze(final Component component) {
         return meta;
     }
 
+    private String getPackageName(final PackageURL pUrl) {
+        if (pUrl.getNamespace() != null) {
+            return pUrl.getNamespace().replace("@", "%40") + "%2F" + pUrl.getName();
+        } else {
+            return pUrl.getName();
+        }
+    }
+
+    private void analyzeReleases(final MetaModel meta, final JSONArray releasesArray) {
+        // get list of versions and published timestamps
+        Map<String, String> versions = new HashMap<>();
+        for (int i = 0; i<releasesArray.length(); i++) {
+            JSONObject release = releasesArray.getJSONObject(i);
+            final String version = release.optString("version", null);
+            final String insertedAt = release.optString("inserted_at", null);
+            versions.put(version, insertedAt);
+        }
+        final String highestVersion = ComponentVersion.findHighestVersion(new ArrayList<>(versions.keySet()));
+        meta.setLatestVersion(highestVersion);
+
+        final String insertedAt = versions.get(highestVersion);
+        meta.setPublishedTimestamp(getPublishedTimestamp(insertedAt));
+    }
+
+    private Date getPublishedTimestamp(final String insertedAt) {
+        final DateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss");
+        Date publishedTimestamp = null;
+        try {
+            publishedTimestamp = dateFormat.parse(insertedAt);
+        } catch (ParseException e) {
+            LOGGER.warn("An error occurred while parsing published time", e);
+        }
+        return publishedTimestamp;
+    }
+
 }
diff --git a/src/main/java/org/dependencytrack/tasks/repositories/MavenMetaAnalyzer.java b/src/main/java/org/dependencytrack/tasks/repositories/MavenMetaAnalyzer.java
index 302e1c0fa9..b95d042de6 100644
--- a/src/main/java/org/dependencytrack/tasks/repositories/MavenMetaAnalyzer.java
+++ b/src/main/java/org/dependencytrack/tasks/repositories/MavenMetaAnalyzer.java
@@ -18,27 +18,31 @@
  */
 package org.dependencytrack.tasks.repositories;
 
-import alpine.common.logging.Logger;
-import com.github.packageurl.PackageURL;
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.ArrayList;
+import java.util.List;
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.xpath.XPath;
+import javax.xml.xpath.XPathConstants;
+import javax.xml.xpath.XPathExpression;
+import javax.xml.xpath.XPathExpressionException;
+import javax.xml.xpath.XPathFactory;
 import org.apache.http.HttpEntity;
 import org.apache.http.HttpStatus;
 import org.apache.http.client.methods.CloseableHttpResponse;
 import org.dependencytrack.exception.MetaAnalyzerException;
 import org.dependencytrack.model.Component;
 import org.dependencytrack.model.RepositoryType;
+import org.dependencytrack.util.ComponentVersion;
 import org.dependencytrack.util.DateUtil;
 import org.dependencytrack.util.XmlUtil;
 import org.w3c.dom.Document;
+import org.w3c.dom.Node;
+import org.w3c.dom.NodeList;
 import org.xml.sax.SAXException;
-
-import javax.xml.parsers.ParserConfigurationException;
-import javax.xml.xpath.XPath;
-import javax.xml.xpath.XPathConstants;
-import javax.xml.xpath.XPathExpression;
-import javax.xml.xpath.XPathExpressionException;
-import javax.xml.xpath.XPathFactory;
-import java.io.IOException;
-import java.io.InputStream;
+import com.github.packageurl.PackageURL;
+import alpine.common.logging.Logger;
 
 /**
  * An IMetaAnalyzer implementation that supports Maven repositories (including Maven Central).
@@ -76,29 +80,14 @@ public RepositoryType supportedRepositoryType() {
     public MetaModel analyze(final Component component) {
         final MetaModel meta = new MetaModel(component);
         if (component.getPurl() != null) {
-            final String mavenGavUrl = component.getPurl().getNamespace().replaceAll("\\.", "/") + "/" + component.getPurl().getName();
+            final String mavenGavUrl = component.getPurl().getNamespace().replace(".", "/") + "/" + component.getPurl().getName();
             final String url = String.format(baseUrl + REPO_METADATA_URL, mavenGavUrl);
             try (final CloseableHttpResponse response = processHttpRequest(url)) {
                 if (response.getStatusLine().getStatusCode() == HttpStatus.SC_OK) {
                     final HttpEntity entity = response.getEntity();
                     if (entity != null) {
                         try (InputStream in = entity.getContent()) {
-                            final Document document = XmlUtil.buildSecureDocumentBuilder().parse(in);
-                            final var xpathFactory = XPathFactory.newInstance();
-                            final XPath xpath = xpathFactory.newXPath();
-
-                            final XPathExpression releaseExpression = xpath.compile("/metadata/versioning/release");
-                            final XPathExpression latestExpression = xpath.compile("/metadata/versioning/latest");
-                            final var release = (String) releaseExpression.evaluate(document, XPathConstants.STRING);
-                            final String latest = (String) latestExpression.evaluate(document, XPathConstants.STRING);
-
-                            final XPathExpression lastUpdatedExpression = xpath.compile("/metadata/versioning/lastUpdated");
-                            final var lastUpdated = (String) lastUpdatedExpression.evaluate(document, XPathConstants.STRING);
-
-                            meta.setLatestVersion(release != null ? release : latest);
-                            if (lastUpdated != null) {
-                                meta.setPublishedTimestamp(DateUtil.parseDate(lastUpdated));
-                            }
+                            analyzeContent(meta, in);
                         }
                     }
                 } else {
@@ -113,4 +102,70 @@ public MetaModel analyze(final Component component) {
         }
         return meta;
     }
+
+    /**
+     * The maven-metadata.xml files are not updated by Nexus during deployment, they are updated by Maven. It downloads the file, updates it, and then redeploys it.
+     *
+     * Maven will update the "release" field only during the following scenarios:
+     *
+     * 1. Maven 2.x deploys using -DupdateReleaseInfo=true
+     * 2. Maven 3.x deploys a non-snapshot artifact
+     *
+     * The "latest" field is only intended for plugin resolution, and is only set upon deployment of a maven-plugin artifact, both for Maven 2.x and 3.x regardless whether a release or snapshot gets deployed.
+     *
+     * Also, Maven will update these fields with whatever version it is currently deploying, so "latest" and "release" will not necessarily correspond to the highest version number.
+     *
+     * https://support.sonatype.com/hc/en-us/articles/213464638-Why-are-the-latest-and-release-tags-in-maven-metadata-xml-not-being-updated-after-deploying-artifacts-
+     */
+    private void analyzeContent(final MetaModel meta, InputStream in)
+            throws SAXException, IOException, ParserConfigurationException, XPathExpressionException {
+
+        final Document document = XmlUtil.buildSecureDocumentBuilder().parse(in);
+        final XPathFactory xpathFactory = XPathFactory.newInstance();
+        final XPath xpath = xpathFactory.newXPath();
+
+        // latest: What the latest version in the directory is, including snapshots
+        final String latest = getLatestVersionFromMetadata(document, xpath);
+        // When the metadata was last updated
+        final String lastUpdated = getLastUpdatedFromMetadata(document, xpath);
+        // versions/version*: (Many) Versions available of the artifact (both releases and snapshots)
+        final NodeList versionsList = getVersionsFromMetadata(document, xpath);
+
+        // latest and release might not be the highest version in case of a hotfix on an older release!
+
+        // find highest stable or unstable version from list of versions
+        List<String> versions = getVersions(versionsList);
+        String highestVersion = ComponentVersion.findHighestVersion(versions);
+        meta.setLatestVersion(highestVersion);
+        if (lastUpdated != null && highestVersion != null && highestVersion.equals(latest)) {
+            // lastUpdated reflects the timestamp when latest was updated, so it's only valid when highestVersion == latest
+            meta.setPublishedTimestamp(DateUtil.parseDate(lastUpdated));
+        }
+    }
+
+    private NodeList getVersionsFromMetadata(final Document document, final XPath xpath) throws XPathExpressionException {
+        final XPathExpression versionsExpression = xpath.compile("/metadata/versioning/versions/*");
+        return (NodeList) versionsExpression.evaluate(document, XPathConstants.NODESET);
+    }
+
+    private String getLastUpdatedFromMetadata(final Document document, final XPath xpath) throws XPathExpressionException {
+        final XPathExpression lastUpdatedExpression = xpath.compile("/metadata/versioning/lastUpdated");
+        return (String) lastUpdatedExpression.evaluate(document, XPathConstants.STRING);
+    }
+
+    private String getLatestVersionFromMetadata(final Document document, final XPath xpath) throws XPathExpressionException {
+        final XPathExpression latestExpression = xpath.compile("/metadata/versioning/latest");
+        return (String) latestExpression.evaluate(document, XPathConstants.STRING);
+    }
+
+    private List<String> getVersions(final NodeList versionsList) {
+        List<String> versions = new ArrayList<>();
+        for (int n = 0; n < versionsList.getLength(); n++) {
+            Node versionNode = versionsList.item(n);
+            String version = versionNode.getFirstChild().getNodeValue().trim();
+            versions.add(version);
+        }
+        return versions;
+    }
+
 }
diff --git a/src/main/java/org/dependencytrack/tasks/repositories/NpmMetaAnalyzer.java b/src/main/java/org/dependencytrack/tasks/repositories/NpmMetaAnalyzer.java
index 1142712aa3..4c5445d460 100644
--- a/src/main/java/org/dependencytrack/tasks/repositories/NpmMetaAnalyzer.java
+++ b/src/main/java/org/dependencytrack/tasks/repositories/NpmMetaAnalyzer.java
@@ -18,17 +18,19 @@
  */
 package org.dependencytrack.tasks.repositories;
 
-import alpine.common.logging.Logger;
-import com.github.packageurl.PackageURL;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
 import org.apache.http.HttpStatus;
 import org.apache.http.client.methods.CloseableHttpResponse;
 import org.apache.http.util.EntityUtils;
 import org.dependencytrack.exception.MetaAnalyzerException;
 import org.dependencytrack.model.Component;
 import org.dependencytrack.model.RepositoryType;
+import org.dependencytrack.util.ComponentVersion;
 import org.json.JSONObject;
-
-import java.io.IOException;
+import com.github.packageurl.PackageURL;
+import alpine.common.logging.Logger;
 
 /**
  * An IMetaAnalyzer implementation that supports NPM.
@@ -40,7 +42,7 @@ public class NpmMetaAnalyzer extends AbstractMetaAnalyzer {
 
     private static final Logger LOGGER = Logger.getLogger(NpmMetaAnalyzer.class);
     private static final String DEFAULT_BASE_URL = "https://registry.npmjs.org";
-    private static final String API_URL = "/-/package/%s/dist-tags";
+    private static final String API_URL = "/%s/";
 
     NpmMetaAnalyzer() {
         this.baseUrl = DEFAULT_BASE_URL;
@@ -78,12 +80,9 @@ public MetaModel analyze(final Component component) {
             try (final CloseableHttpResponse response = processHttpRequest(url)) {
                 if (response.getStatusLine().getStatusCode() == HttpStatus.SC_OK) {
                     if (response.getEntity()!=null) {
-                        String responseString = EntityUtils.toString(response.getEntity());
-                        var jsonObject = new JSONObject(responseString);
-                        final String latest = jsonObject.optString("latest");
-                        if (latest != null) {
-                            meta.setLatestVersion(latest);
-                        }
+                        final String responseString = EntityUtils.toString(response.getEntity());
+                        final JSONObject responseObject = new JSONObject(responseString);
+                        analyzeResponse(meta, responseObject);
                     }
                 } else {
                     handleUnexpectedHttpResponse(LOGGER, url, response.getStatusLine().getStatusCode(), response.getStatusLine().getReasonPhrase(), component);
@@ -97,4 +96,11 @@ public MetaModel analyze(final Component component) {
         return meta;
     }
 
+    private void analyzeResponse(final MetaModel meta, JSONObject response) {
+        final JSONObject versionsObject = response.getJSONObject("versions");
+        final List<String> versions = new ArrayList<>(versionsObject.keySet());
+        final String highestVersion = ComponentVersion.findHighestVersion(versions);
+        meta.setLatestVersion(highestVersion);
+    }
+
 }
diff --git a/src/main/java/org/dependencytrack/tasks/repositories/NugetMetaAnalyzer.java b/src/main/java/org/dependencytrack/tasks/repositories/NugetMetaAnalyzer.java
index cf4343cab5..a17e6b5e59 100644
--- a/src/main/java/org/dependencytrack/tasks/repositories/NugetMetaAnalyzer.java
+++ b/src/main/java/org/dependencytrack/tasks/repositories/NugetMetaAnalyzer.java
@@ -18,23 +18,23 @@
  */
 package org.dependencytrack.tasks.repositories;
 
-import alpine.common.logging.Logger;
-import com.github.packageurl.PackageURL;
+import java.io.IOException;
+import java.text.DateFormat;
+import java.text.ParseException;
+import java.text.SimpleDateFormat;
+import java.util.Date;
+import java.util.List;
 import org.apache.http.HttpStatus;
 import org.apache.http.client.methods.CloseableHttpResponse;
 import org.apache.http.util.EntityUtils;
-import org.apache.maven.artifact.versioning.ComparableVersion;
 import org.dependencytrack.exception.MetaAnalyzerException;
 import org.dependencytrack.model.Component;
 import org.dependencytrack.model.RepositoryType;
+import org.dependencytrack.util.ComponentVersion;
 import org.json.JSONArray;
 import org.json.JSONObject;
-
-import java.io.IOException;
-import java.text.DateFormat;
-import java.text.ParseException;
-import java.text.SimpleDateFormat;
-import java.util.Date;
+import com.github.packageurl.PackageURL;
+import alpine.common.logging.Logger;
 
 /**
  * An IMetaAnalyzer implementation that supports Nuget.
@@ -44,7 +44,7 @@
  */
 public class NugetMetaAnalyzer extends AbstractMetaAnalyzer {
 
-    public static final DateFormat[] SUPPORTED_DATE_FORMATS = new DateFormat[]{
+    private static final DateFormat[] SUPPORTED_DATE_FORMATS = new DateFormat[]{
             new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSSXXX"),
             new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss'Z'")
     };
@@ -95,10 +95,8 @@ public RepositoryType supportedRepositoryType() {
      */
     public MetaModel analyze(final Component component) {
         final MetaModel meta = new MetaModel(component);
-        if (component.getPurl() != null) {
-            if (performVersionCheck(meta, component)) {
-                performLastPublishedCheck(meta, component);
-            }
+        if ((component.getPurl() != null) && performVersionCheck(meta, component)) {
+            performLastPublishedCheck(meta, component);
         }
         return meta;
     }
@@ -108,11 +106,12 @@ private boolean performVersionCheck(final MetaModel meta, final Component compon
         try (final CloseableHttpResponse response = processHttpRequest(url)) {
             if (response.getStatusLine().getStatusCode() == HttpStatus.SC_OK) {
                 if (response.getEntity() != null) {
-                    String responseString = EntityUtils.toString(response.getEntity());
-                    var jsonObject = new JSONObject(responseString);
-                    final JSONArray versions = jsonObject.getJSONArray("versions");
-                    final String latest = findLatestVersion(versions); // get the last version in the array
-                    meta.setLatestVersion(latest);
+                    final String responseString = EntityUtils.toString(response.getEntity());
+                    final JSONObject jsonObject = new JSONObject(responseString);
+                    final JSONArray versionsArray = jsonObject.getJSONArray("versions");
+                    final List<String> versions = versionsArray.toList().stream().map(Object::toString).toList();
+                    final String highestVersion = ComponentVersion.findHighestVersion(versions);
+                    meta.setLatestVersion(highestVersion);
                 }
                 return true;
             } else {
@@ -126,23 +125,6 @@ private boolean performVersionCheck(final MetaModel meta, final Component compon
         return false;
     }
 
-    private String findLatestVersion(JSONArray versions) {
-        if (versions.length() < 1) {
-            return null;
-        }
-
-        ComparableVersion latestVersion = new ComparableVersion(versions.getString(0));
-
-        for (int i = 1; i < versions.length(); i++) {
-            ComparableVersion version = new ComparableVersion(versions.getString(i));
-            if (version.compareTo(latestVersion) > 0) {
-                latestVersion = version;
-            }
-        }
-
-        return latestVersion.toString();
-    }
-
     private boolean performLastPublishedCheck(final MetaModel meta, final Component component) {
         final String url = String.format(registrationUrl, component.getPurl().getName().toLowerCase(), meta.getLatestVersion());
         try (final CloseableHttpResponse response = processHttpRequest(url)) {
@@ -173,17 +155,15 @@ private void initializeEndpoints() {
         final String url = baseUrl + INDEX_URL;
         try {
             try (final CloseableHttpResponse response = processHttpRequest(url)) {
-                if (response.getStatusLine().getStatusCode() == HttpStatus.SC_OK) {
-                    if(response.getEntity()!=null){
-                    String responseString = EntityUtils.toString(response.getEntity());
-                        JSONObject responseJson = new JSONObject(responseString);
-                        final JSONArray resources = responseJson.getJSONArray("resources");
-                        final JSONObject packageBaseResource = findResourceByType(resources, "PackageBaseAddress");
-                        final JSONObject registrationsBaseResource = findResourceByType(resources, "RegistrationsBaseUrl");
-                        if (packageBaseResource != null && registrationsBaseResource != null) {
-                            versionQueryUrl = packageBaseResource.getString("@id") + "%s/index.json";
-                            registrationUrl = registrationsBaseResource.getString("@id") + "%s/%s.json";
-                        }
+                if ((response.getStatusLine().getStatusCode() == HttpStatus.SC_OK) && (response.getEntity() != null)) {
+                    final String responseString = EntityUtils.toString(response.getEntity());
+                    final JSONObject responseJson = new JSONObject(responseString);
+                    final JSONArray resources = responseJson.getJSONArray("resources");
+                    final JSONObject packageBaseResource = findResourceByType(resources, "PackageBaseAddress");
+                    final JSONObject registrationsBaseResource = findResourceByType(resources, "RegistrationsBaseUrl");
+                    if (packageBaseResource != null && registrationsBaseResource != null) {
+                        versionQueryUrl = packageBaseResource.getString("@id") + "%s/index.json";
+                        registrationUrl = registrationsBaseResource.getString("@id") + "%s/%s.json";
                     }
                 }
             }
diff --git a/src/main/java/org/dependencytrack/tasks/repositories/PypiMetaAnalyzer.java b/src/main/java/org/dependencytrack/tasks/repositories/PypiMetaAnalyzer.java
index 2c950bc084..1bd398f803 100644
--- a/src/main/java/org/dependencytrack/tasks/repositories/PypiMetaAnalyzer.java
+++ b/src/main/java/org/dependencytrack/tasks/repositories/PypiMetaAnalyzer.java
@@ -18,22 +18,23 @@
  */
 package org.dependencytrack.tasks.repositories;
 
-import alpine.common.logging.Logger;
-import com.github.packageurl.PackageURL;
+import java.io.IOException;
+import java.text.DateFormat;
+import java.text.ParseException;
+import java.text.SimpleDateFormat;
+import java.util.ArrayList;
+import java.util.Date;
+import java.util.List;
 import org.apache.http.HttpStatus;
 import org.apache.http.client.methods.CloseableHttpResponse;
 import org.apache.http.util.EntityUtils;
 import org.dependencytrack.exception.MetaAnalyzerException;
 import org.dependencytrack.model.Component;
 import org.dependencytrack.model.RepositoryType;
-import org.json.JSONArray;
+import org.dependencytrack.util.ComponentVersion;
 import org.json.JSONObject;
-
-import java.io.IOException;
-import java.text.DateFormat;
-import java.text.ParseException;
-import java.text.SimpleDateFormat;
-import java.util.Date;
+import com.github.packageurl.PackageURL;
+import alpine.common.logging.Logger;
 
 /**
  * An IMetaAnalyzer implementation that supports Pypi.
@@ -75,28 +76,10 @@ public MetaModel analyze(final Component component) {
             try (final CloseableHttpResponse response = processHttpRequest(url)) {
                 if (response.getStatusLine().getStatusCode() == HttpStatus.SC_OK) {
                     if (response.getEntity() != null) {
-                        String stringResponse = EntityUtils.toString(response.getEntity());
-                        JSONObject jsonObject = new JSONObject(stringResponse);
-                        final JSONObject info = jsonObject.getJSONObject("info");
-                        final String latest = info.optString("version", null);
-                        if (latest != null) {
-                            meta.setLatestVersion(latest);
-                            final JSONObject releases = jsonObject.getJSONObject("releases");
-                            final JSONArray latestArray = releases.getJSONArray(latest);
-                            if (latestArray.length() > 0) {
-                                final JSONObject release = latestArray.getJSONObject(0);
-                                final String updateTime = release.optString("upload_time", null);
-                                if (updateTime != null) {
-                                    final DateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss");
-                                    try {
-                                        final Date published = dateFormat.parse(updateTime);
-                                        meta.setPublishedTimestamp(published);
-                                    } catch (ParseException e) {
-                                        LOGGER.warn("An error occurred while parsing upload time", e);
-                                    }
-                                }
-                            }
-                        }
+                        final String stringResponse = EntityUtils.toString(response.getEntity());
+                        final JSONObject jsonObject = new JSONObject(stringResponse);
+                        final JSONObject releases = jsonObject.getJSONObject("releases");
+                        analyzeReleases(meta, releases);
                     }
                 } else {
                     handleUnexpectedHttpResponse(LOGGER, url, response.getStatusLine().getStatusCode(), response.getStatusLine().getReasonPhrase(), component);
@@ -109,4 +92,29 @@ public MetaModel analyze(final Component component) {
         }
         return meta;
     }
-}
\ No newline at end of file
+
+    private void analyzeReleases(final MetaModel meta, final JSONObject releases) {
+        List<String> versions = new ArrayList<>(releases.keySet());
+        final String highestVersion = ComponentVersion.findHighestVersion(versions);
+        meta.setLatestVersion(highestVersion);
+        if (highestVersion != null) {
+            final JSONObject release = releases.getJSONArray(highestVersion).getJSONObject(0);
+            final String updateTime = release.optString("upload_time", null);
+            if (updateTime != null) {
+                Date published = getPublishedTimestamp(updateTime);
+                meta.setPublishedTimestamp(published);
+            }
+        }
+    }
+
+    private Date getPublishedTimestamp(final String updateTime) {
+        final DateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss");
+        Date published = null;
+        try {
+            published = dateFormat.parse(updateTime);
+        } catch (ParseException e) {
+            LOGGER.warn("An error occurred while parsing upload time", e);
+        }
+        return published;
+    }
+}
diff --git a/src/main/java/org/dependencytrack/tasks/scanners/AbstractVulnerableSoftwareAnalysisTask.java b/src/main/java/org/dependencytrack/tasks/scanners/AbstractVulnerableSoftwareAnalysisTask.java
index 6937f63dba..856b457f7b 100644
--- a/src/main/java/org/dependencytrack/tasks/scanners/AbstractVulnerableSoftwareAnalysisTask.java
+++ b/src/main/java/org/dependencytrack/tasks/scanners/AbstractVulnerableSoftwareAnalysisTask.java
@@ -27,7 +27,6 @@
 import org.dependencytrack.util.NotificationUtil;
 import us.springett.parsers.cpe.Cpe;
 import us.springett.parsers.cpe.values.LogicalValue;
-
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 import java.util.List;
@@ -72,19 +71,25 @@ protected void analyzeVersionRange(final QueryManager qm, final List<VulnerableS
      * versionStartIncluding.
      *
      * @param vs a reference to the vulnerable software to compare
-     * @param targetVersion the version to compare
+     * @param targetVersion the CPE version to comparez, might contain wildcards
      * @return <code>true</code> if the target version is matched; otherwise
      * <code>false</code>
      *
      * Ported from Dependency-Check v5.2.1
      */
     private static boolean compareVersions(VulnerableSoftware vs, String targetVersion) {
+        // For VulnerableSoftware (could actually be hardware) without a version number.
+        // e.g. cpe:2.3:o:intel:2000e_firmware:-:*:*:*:*:*:*:*
+        if (LogicalValue.NA.getAbbreviation().equals(vs.getVersion())) {
+            return true;
+        }
         //if any of the four conditions will be evaluated - then true;
         boolean result = (vs.getVersionEndExcluding() != null && !vs.getVersionEndExcluding().isEmpty())
                 || (vs.getVersionStartExcluding() != null && !vs.getVersionStartExcluding().isEmpty())
                 || (vs.getVersionEndIncluding() != null && !vs.getVersionEndIncluding().isEmpty())
                 || (vs.getVersionStartIncluding() != null && !vs.getVersionStartIncluding().isEmpty());
 
+        // Check for CPE wilcards first, before comparing versions
         // Modified from original by Steve Springett
         // Added null check: vs.getVersion() != null as purl sources that use version ranges may not have version populated.
         if (!result && vs.getVersion() != null && compareAttributes(vs.getVersion(), targetVersion)) {
@@ -92,9 +97,6 @@ private static boolean compareVersions(VulnerableSoftware vs, String targetVersi
         }
 
         final ComponentVersion target = new ComponentVersion(targetVersion);
-        if (target.getVersionParts().isEmpty()) {
-            return false;
-        }
         if (result && vs.getVersionEndExcluding() != null && !vs.getVersionEndExcluding().isEmpty()) {
             final ComponentVersion endExcluding = new ComponentVersion(vs.getVersionEndExcluding());
             result = endExcluding.compareTo(target) > 0;
diff --git a/src/main/java/org/dependencytrack/upgrade/v490/v490Updater.java b/src/main/java/org/dependencytrack/upgrade/v490/v490Updater.java
index 5b4db59e09..e14ee26712 100644
--- a/src/main/java/org/dependencytrack/upgrade/v490/v490Updater.java
+++ b/src/main/java/org/dependencytrack/upgrade/v490/v490Updater.java
@@ -21,10 +21,9 @@
 import alpine.common.logging.Logger;
 import alpine.persistence.AlpineQueryManager;
 import alpine.server.upgrade.AbstractUpgradeItem;
-
+import alpine.server.util.DbUtil;
 import java.sql.Connection;
 import java.sql.PreparedStatement;
-
 import static org.dependencytrack.model.ConfigPropertyConstants.SCANNER_SNYK_API_VERSION;
 
 public class v490Updater extends AbstractUpgradeItem {
@@ -39,6 +38,7 @@ public String getSchemaVersion() {
     @Override
     public void executeUpgrade(final AlpineQueryManager qm, final Connection connection) throws Exception {
         updateDefaultSnykApiVersion(connection);
+        removeUnstableVersionsFromAnalysisCacheAndRepoMetadata(connection);
     }
 
     /**
@@ -62,4 +62,20 @@ private static void updateDefaultSnykApiVersion(final Connection connection) thr
         }
     }
 
+    /**
+     * Versions with a '-' in it probably indicate unstable versions. Remove them all
+     * from component analysis cache and repository metadata, so only stable versions
+     * remain.
+     *
+     * @param connection The {@link Connection} to use for executing queries
+     * @throws Exception When executing a query failed
+     * @see: https://github.com/DependencyTrack/dependency-track/issues/2500
+     */
+    private void removeUnstableVersionsFromAnalysisCacheAndRepoMetadata(Connection connection) throws Exception {
+        LOGGER.info("Removing possible unstable versions from component analysis cache");
+        DbUtil.executeUpdate(connection, "DELETE FROM \"COMPONENTANALYSISCACHE\" WHERE RESULT LIKE '%-%'");
+        LOGGER.info("Removing possible unstable versions from repository metadata");
+        DbUtil.executeUpdate(connection, "DELETE FROM \"REPOSITORY_META_COMPONENT\" WHERE LATEST_VERSION LIKE '%-%'");
+    }
+
 }
diff --git a/src/main/java/org/dependencytrack/util/ComponentVersion.java b/src/main/java/org/dependencytrack/util/ComponentVersion.java
index f31422162f..2c91e1c24f 100644
--- a/src/main/java/org/dependencytrack/util/ComponentVersion.java
+++ b/src/main/java/org/dependencytrack/util/ComponentVersion.java
@@ -18,115 +18,221 @@
  */
 package org.dependencytrack.util;
 
-import org.apache.commons.lang3.StringUtils;
+import com.vdurmont.semver4j.Semver;
 import org.apache.commons.lang3.builder.HashCodeBuilder;
-
-import javax.annotation.concurrent.NotThreadSafe;
-import java.util.ArrayList;
-import java.util.Iterator;
+import org.apache.maven.artifact.versioning.ComparableVersion;
 import java.util.List;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
-/**
- * <p>
- * Simple object to track the parts of a version number. The parts are contained
- * in a List such that version 1.2.3 will be stored as:  <code>versionParts[0] = 1;
- * versionParts[1] = 2;
- * versionParts[2] = 3;
- * </code></p>
- * <p>
- * Note, the parser contained in this class expects the version numbers to be
- * separated by periods. If a different separator is used the parser will likely
- * fail.</p>
- *
- * @author Jeremy Long
- *
- * Ported from DependencyVersion in Dependency-Check v5.2.1
- */
-@NotThreadSafe
-public class ComponentVersion implements Iterable<String>, Comparable<ComponentVersion> {
+public class ComponentVersion implements Comparable<ComponentVersion> {
+
+    // Optional epoch part: number before the first : sign
+    protected static final String EPOCH_PATTERN_STRING = "^(?:(?<epoch>\\d*):)?";
+
+    // Optional label: everything after a ~, ^ or - sign, or after a . sign when it doesn't start with a number
+    protected static final String LABEL_PATTERN_STRING = "(?<label>[-~^].*?|\\.[a-z].*?)?";
+
+    // Optional build metadata: everyhing after the last + sign:
+    protected static final String BUILD_METADATA_PATTERN_STRING = "(?:\\+.*)?";
+
+    // Non-semver version:any numbers parts optionally appended with characters
+    // or numbers separated by dots (max 5 groups), with optial leading v.
+    // Optionally appended with label and/or build metadata
+    protected static final Pattern NONSEMVER_VERSIONS_PATTERN = Pattern.compile(
+        EPOCH_PATTERN_STRING + // epoch
+        "(?<version>v?\\d+[a-z0-9]*(?:\\.\\d+[a-z0-9]*){0,5})" + // version part
+        LABEL_PATTERN_STRING + // label part
+        BUILD_METADATA_PATTERN_STRING + "$", // build metadata part
+        Pattern.CASE_INSENSITIVE
+        );
+
+
+    // Ubuntu version format:
+    // https://wiki.ubuntu.com/AutoStatic/PackagingVersioningScheme
+    // https://docs.fedoraproject.org/en-US/packaging-guidelines/Versioning/
+    // anything containing "ubuntu" or "ppa" is considered a debian version
+    protected static final String PPA_PATTER_STRING = "(?:ppa(\\d.*))"; // needs group wrap since ? might be appended!
+                                                                        // unable to name the group since pattern is used multiple times
+    protected static final String UBUNTU_PATTERN_STRING = "ubuntu(?<os>\\d.*?)";
+    protected static final Pattern UBUNTU_RELEASE_PATTERN = Pattern.compile(
+        EPOCH_PATTERN_STRING +
+        "(?<version>.*?)" + // version part, many variations here...
+        "(?:" +
+        UBUNTU_PATTERN_STRING + PPA_PATTER_STRING + "?" + // ubuntu version + optional ppa version
+        "|" + PPA_PATTER_STRING + // ppa version only
+        ")" + LABEL_PATTERN_STRING + BUILD_METADATA_PATTERN_STRING + "$",
+        Pattern.CASE_INSENSITIVE
+    );
+
+    // Debian version format:
+    // https://www.debian.org/doc/manuals/developers-reference/pkgs.html
+    // https://blog.jasonantman.com/2014/07/how-yum-and-rpm-compare-versions/
+    // anything containing "deb", "dfsg" or "ds" is considered a debian version
+    private static final String DEBIAN_PATTERN_STRING = "(?:\\+deb(?<os>\\d+(?:u\\d+)?))";
+    private static final String DFSG_PATTERN_STRING = "(?:[\\+-](?:dfsg|ds)[\\.-]?(\\d*-?\\d*))"; // needs group wraps since ? might be appended!
+                                                                                                  // unable to name the group, since pattern is used multiple times
+    protected static final Pattern DEBIAN_RELEASE_PATTERN = Pattern.compile(
+        EPOCH_PATTERN_STRING +
+        "(?<version>.*?)" + // version part, many variations here...
+        "(?:" +
+        "(?:" + DFSG_PATTERN_STRING + ")?" + DEBIAN_PATTERN_STRING + // debian release + optional DFSG part
+        "|" + DFSG_PATTERN_STRING + // DFSG part only
+        ")" + LABEL_PATTERN_STRING + BUILD_METADATA_PATTERN_STRING + "$",
+        Pattern.CASE_INSENSITIVE
+        );
+
+    // Semver version format:
+    // https://semver.org/
+    // restricted number, label and build metadata parts to preven ReDOS attacks.
+    protected static final Pattern SEMVER_PATTERN = Pattern.compile("^(0|[1-9]\\d{0,32})\\.(0|[1-9]\\d{0,32})\\.(0|[1-9]\\d{0,32})(?:-((?:0|[1-9]\\d{0,32}|\\d{0,32}[a-zA-Z-][0-9a-zA-Z-]{0,100})(?:\\.(?:0|[1-9]\\d{0,32}|\\d{0,32}[a-zA-Z-][0-9a-zA-Z-]{0,100})){0,8}))?(?:\\+([0-9a-zA-Z-]{1,100}(?:\\.[0-9a-zA-Z-]{1,100}){0,8}))?$");
+
+    protected static final Pattern SEMVER_PRE_RELEASE_PATTERN = Pattern.compile("(-[0-9a-z]).*", Pattern.CASE_INSENSITIVE);
+
+    // Well-known labels denoting unstable versions
+    protected static final Pattern UNSTABLE_LABELS_PATTERN = Pattern.compile("[\\.-](dev|atlassian|preview|next|canary|snapshot|a|alpha|b|beta|rc|cr|m|mr|ea).*", Pattern.CASE_INSENSITIVE);
 
     /**
-     * A list of the version parts.
+     * Parse two version strings  and compare the versions using {@link ComponentVersion}
+     *
+     * @param v1string first version to compare
+     * @param v2string second version to compare
+     * @return 0 when the versions are equal, > 0 if v2 is larger than v1, < 0 when v2 is smaler than v1
+     * @see ComponentVersion#compareTo
      */
-    private List<String> versionParts;
+    public static int compareVersions(String v1string, String v2string) {
+        ComponentVersion v1 = new ComponentVersion(v1string);
+        ComponentVersion v2 = new ComponentVersion(v2string);
+        return v1.compareTo(v2);
+    }
 
     /**
-     * Constructor for a empty DependencyVersion.
+     * Parse two version strings and return the one containing the highest version
+     *
+     * @param v1string first version to compare
+     * @param v2string second version to compare
+     * @return the highest of two versions as string value
      */
-    public ComponentVersion() {
+    public static String highestVersion(String v1string, String v2string) {
+        return ComponentVersion.compareVersions(v1string, v2string) > 0 ? v1string : v2string;
     }
 
     /**
-     * Constructor for a DependencyVersion that will parse a version string.
-     * <b>Note</b>, this should only be used when the version passed in is
-     * already known to be a well formatted version number. Otherwise,
-     * DependencyVersionUtil.parseVersion() should be used instead.
+     * Determine wether a version string denotes a SemVer version
      *
-     * @param version the well formatted version number to parse
+     * @param version the version string
+     * @return true if the version string denotes a SemVer version
      */
-    public ComponentVersion(String version) {
-        parseVersion(version);
+    public static boolean isSemVer(String version) {
+        return SEMVER_PATTERN.matcher(version).matches();
     }
 
     /**
-     * Parses a version string into its sub parts: major, minor, revision,
-     * build, etc. <b>Note</b>, this should only be used to parse something that
-     * is already known to be a version number.
+     * Determine wether a version string denotes a stable version
      *
-     * @param version the version string to parse
+     * @param version the version string
+     * @return true if the version string denotes a stable version
      */
-    public final void parseVersion(String version) {
-        versionParts = new ArrayList<>();
-        if (version != null) {
-            // https://github.com/DependencyTrack/dependency-track/issues/1374
-            // handle deb versions
-            String lcVersion = version.toLowerCase();
-            final Pattern debrx = Pattern.compile("^([0-9]+:)?(.*)(-[^-]+ubuntu[^-]+)$");
-            final Matcher debmatcher = debrx.matcher(lcVersion);
-            if (debmatcher.matches()) {
-                lcVersion = debmatcher.group(2);
-            }
+    public static boolean isStableVersion(String version) {
+        final var ubuntuMatcher = UBUNTU_RELEASE_PATTERN.matcher(version);
+        if (ubuntuMatcher.matches()) {
+            return true; // could this be false? how?
+        }
 
-            final Pattern rx = Pattern.compile("(\\d+[a-z]{1,3}$|[a-z]{1,3}[_-]?\\d+|\\d+|(rc|release|snapshot|beta|alpha)$)",
-                    Pattern.CASE_INSENSITIVE);
-            final Matcher matcher = rx.matcher(lcVersion);
-            while (matcher.find()) {
-                versionParts.add(matcher.group());
-            }
-            if (versionParts.isEmpty()) {
-                versionParts.add(version);
-            }
+        final var debianMatcher = DEBIAN_RELEASE_PATTERN.matcher(version);
+        if (debianMatcher.matches()) {
+            return true; // could this be false? how?
+        }
+
+        if (ComponentVersion.isSemVer(version)) {
+            return new Semver(version).isStable();
+        }
+
+        Matcher versionMatcher = NONSEMVER_VERSIONS_PATTERN.matcher(version);
+        if (versionMatcher.matches()) {
+            String label = versionMatcher.group("label");
+            return !ComponentVersion.isUnstableLabel(label);
+        } else {
+            return false;
         }
     }
 
+    private static boolean isUnstableLabel(String label) {
+        return label != null && (SEMVER_PRE_RELEASE_PATTERN.matcher(label).matches() || UNSTABLE_LABELS_PATTERN.matcher(label).matches());
+
+    }
+
     /**
-     * Get the value of versionParts.
+     * Get the highest version from a list of version strings
      *
-     * @return the value of versionParts
+     * @param versions list of version strings
+     * @return the highest version in the list
      */
-    public List<String> getVersionParts() {
-        return versionParts;
+    public static String findHighestStableOrUnstableVersion(List<String> versions) {
+        String highestStableOrUnstableVersion = null;
+        if (!versions.isEmpty()) {
+            highestStableOrUnstableVersion = versions.stream().reduce(null, ComponentVersion::highestVersion);
+        }
+        return highestStableOrUnstableVersion;
     }
 
     /**
-     * Set the value of versionParts.
+     * Get the highest stable version from a list of version strings
      *
-     * @param versionParts new value of versionParts
+     * @param versions list of version strings
+     * @return the highest version in the list
      */
-    public void setVersionParts(List<String> versionParts) {
-        this.versionParts = versionParts;
+    public static String findHighestStableVersion(List<String> versions) {
+        // collect stable versions
+        List<String> stableVersions = versions.stream().filter(ComponentVersion::isStableVersion).toList();
+        return findHighestStableOrUnstableVersion(stableVersions);
     }
 
+
     /**
-     * Retrieves an iterator for the version parts.
+     * Get the highest  version from a list of version strings. When a stable version is found
+     * this is returned, otherwise an unstable version or null weh no version is found
      *
-     * @return an iterator for the version parts
+     * @param versions list of version strings
+     * @return the highest version in the list
      */
-    @Override
-    public Iterator<String> iterator() {
-        return versionParts.iterator();
+    public static String findHighestVersion(List<String> versions) {
+        // find highest stable version from list of versions
+        String highestStableOrUnstableVersion = ComponentVersion.findHighestStableOrUnstableVersion(versions);
+
+        if (highestStableOrUnstableVersion != null && ComponentVersion.isStableVersion(highestStableOrUnstableVersion)) {
+            return highestStableOrUnstableVersion;
+        } else {
+            // find highest stable version
+            String highestStableVersion = findHighestStableVersion(versions);
+
+            // use highestStableVersion, or else latest unstable release (e.g. alpha, milestone) or else latest snapshot
+            return highestStableVersion != null ? highestStableVersion: highestStableOrUnstableVersion;
+        }
+    }
+
+    /**
+     * The version string
+     */
+    private String version;
+
+    /**
+     * Constructor for a empty DependencyVersion.
+     */
+    public ComponentVersion() {
+    }
+
+    /**
+     * Constructor for a DependencyVersion that will parse a version string.
+     *
+     * @param version the version number to parse
+     */
+    public ComponentVersion(String version) {
+        this.version = version;
+    }
+
+    public String getVersion() {
+        return this.version;
     }
 
     /**
@@ -136,7 +242,7 @@ public Iterator<String> iterator() {
      */
     @Override
     public String toString() {
-        return StringUtils.join(versionParts, '.');
+        return version;
     }
 
     /**
@@ -147,143 +253,333 @@ public String toString() {
      */
     @Override
     public boolean equals(Object obj) {
-        if (obj == null || !(obj instanceof ComponentVersion)) {
+        // self check
+        if (this == obj)
+            return true;
+        // null check
+        if (obj == null)
             return false;
+        // type check and cast
+        if (getClass() != obj.getClass())
+            return false;
+
+        return version.equals(((ComponentVersion)obj).getVersion());
+    }
+
+    /**
+     * Calculates the hashCode for this object.
+     *
+     * @return the hashCode
+     */
+    @Override
+    public int hashCode() {
+        return new HashCodeBuilder(5, 71)
+                .append(version)
+                .toHashCode();
+    }
+
+    @Override
+    public int compareTo(ComponentVersion version) {
+        if (version == null || version.getVersion() == null || "".equals(version.getVersion())) {
+            if (this.getVersion() == null || "".equals(this.getVersion())) {
+                return 0;
+            }
+            return 1;
         }
-        if (this == obj) {
-            return true;
+        if (this.getVersion() == null || "".equals(this.getVersion())) {
+            return -1;
+        }
+        final var v1string = getVersion();
+        final var v2string = version.getVersion();
+        final var v1UbuntuMatcher = UBUNTU_RELEASE_PATTERN.matcher(v1string);
+        final var v2UbuntuMatcher = UBUNTU_RELEASE_PATTERN.matcher(v2string);
+        if (v1UbuntuMatcher.matches() || v2UbuntuMatcher.matches()) {
+            return compareUbuntuVersions(v1string, v2string, v1UbuntuMatcher, v2UbuntuMatcher);
         }
-        final ComponentVersion other = (ComponentVersion) obj;
-        final int minVersionMatchLength = (this.versionParts.size() < other.versionParts.size())
-                ? this.versionParts.size() : other.versionParts.size();
-        final int maxVersionMatchLength = (this.versionParts.size() > other.versionParts.size())
-                ? this.versionParts.size() : other.versionParts.size();
 
-        if (minVersionMatchLength == 1 && maxVersionMatchLength >= 3) {
-            return false;
+        final var v1DebianMatcher = DEBIAN_RELEASE_PATTERN.matcher(v1string);
+        final var v2DebianMatcher = DEBIAN_RELEASE_PATTERN.matcher(v2string);
+        if (v1DebianMatcher.matches() || v2DebianMatcher.matches()) {
+            return compareDebianVersions(v1DebianMatcher, v2DebianMatcher);
         }
 
-        //TODO steal better version of code from compareTo
-        for (int i = 0; i < minVersionMatchLength; i++) {
-            final String thisPart = this.versionParts.get(i);
-            final String otherPart = other.versionParts.get(i);
-            if (!thisPart.equals(otherPart)) {
-                return false;
-            }
+        if (ComponentVersion.isSemVer(v1string) && ComponentVersion.isSemVer(v2string)) {
+            return compareSemver(v1string, v2string);
+        }
+        return compareNonSemverVersions(stripLeadingV(v1string), stripLeadingV(v2string));
+    }
+
+    private int compareDebianVersions(final String v1string, final String v2string) {
+        final var v1DebianMatcher = DEBIAN_RELEASE_PATTERN.matcher(v1string);
+        final var v2DebianMatcher = DEBIAN_RELEASE_PATTERN.matcher(v2string);
+        if (v1DebianMatcher.matches() || v2DebianMatcher.matches()) {
+            return compareDebianVersions(v1DebianMatcher, v2DebianMatcher);
+        }
+        if (ComponentVersion.isSemVer(v1string) && ComponentVersion.isSemVer(v2string)) {
+            return compareSemver(v1string, v2string);
         }
-        if (this.versionParts.size() > minVersionMatchLength) {
-            for (int i = minVersionMatchLength; i < this.versionParts.size(); i++) {
-                if (!"0".equals(this.versionParts.get(i))) {
-                    return false;
+        return compareNonSemverVersions(v1string, v2string);
+    }
+
+    private int compareDebianVersions(final Matcher v1matcher, final Matcher v2matcher) {
+        // compare epoch part
+        final var epoch1 = getEpoch(v1matcher);
+        final var epoch2 = getEpoch(v2matcher);
+
+        final var epochCompare = Integer.compare(Integer.parseInt(epoch1),Integer.parseInt(epoch2));
+        if (epochCompare == 0) {
+            final var version1 = v1matcher.matches() ? v1matcher.group("version") : null;
+            final var version2 = v2matcher.matches() ? v2matcher.group("version") : null;
+            if (version1 == null) {
+                return -1; // 1debian > 1
+            }
+            if (version2 == null) {
+                return 1; // 1 < 1debian
+            }
+            final var versionCompare = compareNonSemverVersions(version1, version2);
+            if (versionCompare == 0) {
+                // compare os version
+                final String osVersion1 = v1matcher.group("os");
+                final String osVersion2 = v2matcher.group("os");
+
+                final var osVersionCompare = compareNonSemverVersions(osVersion1, osVersion2);
+                if (osVersionCompare == 0 ) {
+                    // compare DFSG
+                    final String dfsg1 = v1matcher.matches() ? getDFSG(v1matcher) : null;
+                    final String dfsg2 = v2matcher.matches() ? getDFSG(v2matcher) : null;
+                    if (dfsg1 == null) {
+                        if (dfsg2 == null) {
+                            return 0;
+                        }
+                        return 1; // 1ppa > 1
+                    }
+                    if (dfsg2 == null) {
+                        return -1; // 1 < 1ppa
+                    }
+                    return new ComparableVersion(dfsg1).compareTo(new ComparableVersion(dfsg2));
+                } else {
+                    return osVersionCompare;
                 }
+
             }
+
+            return versionCompare;
         }
+        return epochCompare;
+    }
+
+    private String getEpoch(final Matcher v1matcher) {
+        final var epoch1 = v1matcher.matches() && v1matcher.group("epoch") != null ? v1matcher.group("epoch") : "0";
+        return epoch1;
+    }
 
-        if (other.versionParts.size() > minVersionMatchLength) {
-            for (int i = minVersionMatchLength; i < other.versionParts.size(); i++) {
-                if (!"0".equals(other.versionParts.get(i))) {
-                    return false;
+    private String getDFSG(Matcher matcher) {
+        final var group3 = matcher.group(3);
+        final var group5 = matcher.group(5);
+        return group5 != null ? group5 : group3;
+    }
+
+    private int compareUbuntuVersions(final String v1string, final String v2string, final Matcher v1matcher,
+            final Matcher v2matcher) {
+        final var epoch1 = getEpoch(v1matcher);
+        final var epoch2 = getEpoch(v2matcher);
+
+        final var epochCompare = Integer.compare(Integer.parseInt(epoch1),Integer.parseInt(epoch2));
+        if (epochCompare == 0) {
+            // https://wiki.ubuntu.com/AutoStatic/PackagingVersioningScheme
+            final var debianVersion1 = v1matcher.matches() ? v1matcher.group("version") : v1string;
+            final var debianVersion2 = v2matcher.matches() ? v2matcher.group("version") : v2string;
+            final var debianVersionCompare = compareDebianVersions(debianVersion1, debianVersion2);
+            if (debianVersionCompare == 0) {
+                // compare os versions
+                final var osVersion1 = v1matcher.matches() ? v1matcher.group("os") : null;
+                final var osVersion2 = v2matcher.matches() ? v2matcher.group("os") : null;
+                if (osVersion1 == null && osVersion2 == null) {
+                    return comparePPA(v1matcher, v2matcher);
+                }
+                if (osVersion1 == null) {
+                    return -1; // 1ubuntu > 1
+                }
+                if (osVersion2 == null) {
+                    return 1; // 1 < 1ubuntu
                 }
+                final var osVersionCopare = new ComparableVersion(osVersion1).compareTo(new ComparableVersion(osVersion2));
+                if (osVersionCopare == 0) {
+                    return comparePPA(v1matcher, v2matcher);
+                }
+                // different ubuntu versions might be incompatible, but this is
+                // not taken in consideration here
+                return osVersionCopare;
             }
+            return debianVersionCompare;
         }
+        return epochCompare;
+    }
 
-        /*
-         *  if (this.versionParts != other.versionParts && (this.versionParts == null || !this.versionParts.equals(other.versionParts))) {
-         *      return false;
-         *  }
-         */
-        return true;
+    private int compareSemver(String version1, String version2) {
+        // Defaults to STRICT mode
+        Semver semver1 = new Semver(version1);
+        Semver semver2 = new Semver(version2);
+        return semver1.compareTo(semver2);
     }
 
     /**
-     * Calculates the hashCode for this object.
+     * Compare two non-semver version strings using {@link ComparableVersion}. First
+     * compare the version parts, since {@link ComparableVersion} not alwasy returns correct
+     * results (for example 1.0.10b-1 < 1.0.10-1). Only compare the version labels when
+     * the version parts are equal.
      *
-     * @return the hashCode
+     * @param version1 first version to compare
+     * @param version2 second version to compare
+     * @return < 0 if version1 is the lowest, > 0 when version1 is the highest, 0 when equal.
+     * @see ComparableVersion#compareTo
      */
-    @Override
-    public int hashCode() {
-        return new HashCodeBuilder(5, 71)
-                .append(versionParts)
-                .toHashCode();
+    private int compareNonSemverVersions(String version1, String version2) {
+        if ((version1 == null) && (version2 == null)) {
+            return 0;
+        }
+        if ((version1 != null) && version1.equals(version2)) {
+            return 0;
+        }
+        if (version1 == null) {
+            return 1;
+        }
+        if (version2 == null) {
+            return -1;
+        }
+
+        Matcher v1matcher = NONSEMVER_VERSIONS_PATTERN.matcher(version1);
+        Matcher v2matcher = NONSEMVER_VERSIONS_PATTERN.matcher(version2);
+
+        if (v1matcher.matches() && v2matcher.matches()) {
+            // compare epoch part
+            final var epoch1 = v1matcher.matches() && v1matcher.group("epoch") != null ? v1matcher.group("epoch") : "0";
+            final var epoch2 = v2matcher.matches() && v2matcher.group("epoch") != null ? v2matcher.group("epoch") : "0";
+
+            final var epochCompare = Integer.compare(Integer.parseInt(epoch1),Integer.parseInt(epoch2));
+            if (epochCompare == 0) {
+                final var v1 = v1matcher.group("version");
+                final var v2 = v2matcher.group("version");
+                final var versionCompare = new ComparableVersion(v1).compareTo(new ComparableVersion(v2));
+                if (versionCompare == 0) {
+                    final var v1label = v1matcher.group("label");
+                    final var v2label = v2matcher.group("label");
+                    return compareVersionLabels(v1label, v2label);
+                }
+                return versionCompare;
+            }
+            return epochCompare;
+        }
+        // unrecofnised versions, fallback to ComparableVersion
+        return new ComparableVersion(stripLeadingV(version1)).compareTo(new ComparableVersion(stripLeadingV(version2)));
     }
 
     /**
-     * Determines if the three most major major version parts are identical. For
-     * instances, if version 1.2.3.4 was compared to 1.2.3 this function would
-     * return true.
+     * Compare two version labels by creating dummy versions and
+     * comparing those using {@link ComparableVersion}
      *
-     * @param version the version number to compare
-     * @return true if the first three major parts of the version are identical
+     * @param label1 first label to compare
+     * @param label2 second label to compare
+     * @return < 0 if label1 is the lowest, > 0 when label1 is the highest, 0 when equal.
+     * @see ComparableVersion#compareTo
      */
-    public boolean matchesAtLeastThreeLevels(ComponentVersion version) {
-        if (version == null) {
-            return false;
+    private int compareVersionLabels(String label1, String label2) {
+        if ((label1 == null) && (label2 == null)) {
+            return 0;
         }
-        if (Math.abs(this.versionParts.size() - version.versionParts.size()) >= 3) {
-            return false;
+        if ((label1 != null) && label1.equals(label2)) {
+            return 0;
         }
-
-        final int max = (this.versionParts.size() < version.versionParts.size())
-                ? this.versionParts.size() : version.versionParts.size();
-
-        boolean ret = true;
-        for (int i = 0; i < max; i++) {
-            final String thisVersion = this.versionParts.get(i);
-            final String otherVersion = version.getVersionParts().get(i);
-            if (i >= 3) {
-                if (thisVersion.compareToIgnoreCase(otherVersion) >= 0) {
-                    ret = false;
-                    break;
-                }
-            } else if (!thisVersion.equals(otherVersion)) {
-                ret = false;
-                break;
+        if (label1 == null) {
+            if (!label2.startsWith(".") && (label2.startsWith("~") || isUnstableLabel(label2))) {
+                // 1 > 1-rc1
+                // 1 > 1-alpha
+                // 1 > 1-snapshot
+                // 1 > 1~earlier
+                return 1;
             }
+            // 1 < 1^later
+            // 1 < 1-something
+            return -1;
+        }
+        if (label2 == null) {
+            if (!label1.startsWith(".") && (label1.startsWith("~") || isUnstableLabel(label1))) {
+                // 1-alpha < 1
+                // 1-snapshot < 1
+                // 1~earlier < 1
+                return -1;
+            }
+            // 1.next > 1
+            // 1^later > 1
+            // 1-something > 1
+            return 1;
+        }
+        if (
+            (label1.startsWith("~") && !label2.startsWith("~")) ||
+            (label2.startsWith("^") && !label1.startsWith("^"))
+        ) {
+            // sort earlier
+            return -1;
         }
 
-        return ret;
-    }
-
-    @Override
-    public int compareTo(ComponentVersion version) {
-        if (version == null) {
+        if (
+            (label1.startsWith("^") && !label2.startsWith("^")) ||
+            (label2.startsWith("~") && !label1.startsWith("~"))
+        ) {
+            // sort later
             return 1;
         }
-        final List<String> left = this.getVersionParts();
-        final List<String> right = version.getVersionParts();
-        final int max = left.size() < right.size() ? left.size() : right.size();
-
-        for (int i = 0; i < max; i++) {
-            final String lStr = left.get(i);
-            final String rStr = right.get(i);
-            if (lStr.equals(rStr)) {
-                continue;
-            }
-            try {
-                final int l = Integer.parseInt(lStr);
-                final int r = Integer.parseInt(rStr);
-                if (l < r) {
-                    return -1;
-                } else if (l > r) {
-                    return 1;
-                }
-            } catch (NumberFormatException ex) {
-                final int comp = left.get(i).compareTo(right.get(i));
-                if (comp < 0) {
-                    return -1;
-                } else if (comp > 0) {
-                    return 1;
-                }
+        return new ComparableVersion("1" + label1).compareTo(new ComparableVersion("1" + label2));
+    }
+
+    /**
+     * Compare PPA parts of two versions using {@link ComparableVersion}
+     *
+     * @param v1matcher regex matcher for first version
+     * @param v2matcher regex matcher for second version
+     *
+     * @return < 0 if label1 is the lowest, > 0 when label1 is the highest, 0 when equal.
+     * @see ComparableVersion#compareTo
+     */
+    private int comparePPA(final Matcher v1matcher, final Matcher v2matcher) {
+        // compare ppa
+        final String ppa1 = v1matcher.matches() ? getPPA(v1matcher) : null;
+        final String ppa2 = v2matcher.matches() ? getPPA(v2matcher) : null;
+        if (ppa1 == null) {
+            if (ppa2 == null) {
+                return 0;
             }
+            return -1; // 1 < 1ppa1
         }
-        // Modified from original by Steve Springett
-        // Account for comparisons where one version may be 1.0.0 and another may be 1.0.0.0.
-        if (left.size() == max && right.size() == left.size()+1 && right.get(right.size()-1).equals("0")) {
-            return 0;
-        } else if (right.size() == max && left.size() == right.size()+1 && left.get(left.size()-1).equals("0")) {
-            return 0;
-        } else {
-            return Integer.compare(left.size(), right.size());
+        if (ppa2 == null) {
+            return 1; // 1ppa1 > 1
+        }
+        return new ComparableVersion(ppa1).compareTo(new ComparableVersion(ppa2));
+    }
+
+    /**
+     * Extract PPA part of a version. Depending of the version string, this
+     * might be group 5 or group 4
+     *
+     * @param matcher regex matcher for the version
+     * @return group 5 or group 4, when group 5 is 0
+     */
+    private String getPPA(Matcher matcher) {
+        final var group4 = matcher.group(4);
+        final var group5 = matcher.group(5);
+        return group5 != null ? group5 : group4;
+    }
+
+    /**
+     * remove the 'v' sign when a version string starts with it
+     * @param version  version string
+     * @return version withoud leading 'v'
+     */
+    protected static String stripLeadingV(String version) {
+        if (version == null) {
+            return null;
         }
+        return version.toLowerCase().startsWith("v") ? version.substring(1) : version;
     }
+
 }
diff --git a/src/test/java/org/dependencytrack/tasks/repositories/CargoMetaAnalyzerTest.java b/src/test/java/org/dependencytrack/tasks/repositories/CargoMetaAnalyzerTest.java
index fb20838d32..43b58dcb5f 100644
--- a/src/test/java/org/dependencytrack/tasks/repositories/CargoMetaAnalyzerTest.java
+++ b/src/test/java/org/dependencytrack/tasks/repositories/CargoMetaAnalyzerTest.java
@@ -18,16 +18,17 @@
  */
 package org.dependencytrack.tasks.repositories;
 
-import com.github.packageurl.PackageURL;
 import org.dependencytrack.model.Component;
 import org.dependencytrack.model.RepositoryType;
+import org.dependencytrack.util.ComponentVersion;
 import org.junit.Assert;
 import org.junit.Test;
+import com.github.packageurl.PackageURL;
 
 public class CargoMetaAnalyzerTest {
 
     @Test
-    public void testAnalyzer() throws Exception {
+    public void testAnalyzerForRand() throws Exception {
         Component component = new Component();
         component.setPurl(new PackageURL("pkg:cargo/rand@0.7.2"));
 
@@ -35,6 +36,23 @@ public void testAnalyzer() throws Exception {
         Assert.assertTrue(analyzer.isApplicable(component));
         Assert.assertEquals(RepositoryType.CARGO, analyzer.supportedRepositoryType());
         MetaModel metaModel = analyzer.analyze(component);
+        Assert.assertTrue(metaModel.getLatestVersion().startsWith("0") || ComponentVersion.isStableVersion(metaModel.getLatestVersion())); // 0 is considered unstable in SemVer
+        Assert.assertTrue(ComponentVersion.compareVersions("0.7.1", metaModel.getLatestVersion()) < 0);
+        Assert.assertNotNull(metaModel.getLatestVersion());
+        Assert.assertNotNull(metaModel.getPublishedTimestamp());
+    }
+
+    @Test
+    public void testAnalyzerForBincode() throws Exception {
+        Component component = new Component();
+        component.setPurl(new PackageURL("pkg:cargo/bincode@1.3.0"));
+
+        CargoMetaAnalyzer analyzer = new CargoMetaAnalyzer();
+        Assert.assertTrue(analyzer.isApplicable(component));
+        Assert.assertEquals(RepositoryType.CARGO, analyzer.supportedRepositoryType());
+        MetaModel metaModel = analyzer.analyze(component);
+        Assert.assertTrue(ComponentVersion.isStableVersion(metaModel.getLatestVersion()));
+        Assert.assertTrue(ComponentVersion.compareVersions("1.3.2", metaModel.getLatestVersion()) < 0);
         Assert.assertNotNull(metaModel.getLatestVersion());
         Assert.assertNotNull(metaModel.getPublishedTimestamp());
     }
diff --git a/src/test/java/org/dependencytrack/tasks/repositories/ComposerMetaAnalyzerTest.java b/src/test/java/org/dependencytrack/tasks/repositories/ComposerMetaAnalyzerTest.java
index 67f90a53dc..2d83b5206f 100644
--- a/src/test/java/org/dependencytrack/tasks/repositories/ComposerMetaAnalyzerTest.java
+++ b/src/test/java/org/dependencytrack/tasks/repositories/ComposerMetaAnalyzerTest.java
@@ -18,23 +18,22 @@
  */
 package org.dependencytrack.tasks.repositories;
 
-import com.github.packageurl.PackageURL;
+import static org.mockserver.model.HttpRequest.request;
+import static org.mockserver.model.HttpResponse.response;
+import java.io.File;
+import java.io.FileInputStream;
+import java.text.SimpleDateFormat;
 import org.apache.http.HttpHeaders;
 import org.dependencytrack.model.Component;
 import org.dependencytrack.model.RepositoryType;
+import org.dependencytrack.util.ComponentVersion;
 import org.junit.AfterClass;
 import org.junit.Assert;
 import org.junit.BeforeClass;
 import org.junit.Test;
 import org.mockserver.client.MockServerClient;
 import org.mockserver.integration.ClientAndServer;
-
-import java.io.File;
-import java.io.FileInputStream;
-import java.text.SimpleDateFormat;
-
-import static org.mockserver.model.HttpRequest.request;
-import static org.mockserver.model.HttpResponse.response;
+import com.github.packageurl.PackageURL;
 
 public class ComposerMetaAnalyzerTest {
 
@@ -59,6 +58,8 @@ public void testAnalyzer() throws Exception {
         Assert.assertTrue(analyzer.isApplicable(component));
         Assert.assertEquals(RepositoryType.COMPOSER, analyzer.supportedRepositoryType());
         MetaModel metaModel = analyzer.analyze(component);
+        Assert.assertFalse(metaModel.getLatestVersion().startsWith("v"));
+        Assert.assertTrue(ComponentVersion.compareVersions("10.0.0", metaModel.getLatestVersion()) < 0);
         Assert.assertNotNull(metaModel.getLatestVersion());
         Assert.assertNotNull(metaModel.getPublishedTimestamp());
     }
diff --git a/src/test/java/org/dependencytrack/tasks/repositories/GemMetaAnalyzerTest.java b/src/test/java/org/dependencytrack/tasks/repositories/GemMetaAnalyzerTest.java
index 01b0edbc89..80338cf6c4 100644
--- a/src/test/java/org/dependencytrack/tasks/repositories/GemMetaAnalyzerTest.java
+++ b/src/test/java/org/dependencytrack/tasks/repositories/GemMetaAnalyzerTest.java
@@ -18,16 +18,17 @@
  */
 package org.dependencytrack.tasks.repositories;
 
-import com.github.packageurl.PackageURL;
 import org.dependencytrack.model.Component;
 import org.dependencytrack.model.RepositoryType;
+import org.dependencytrack.util.ComponentVersion;
 import org.junit.Assert;
 import org.junit.Test;
+import com.github.packageurl.PackageURL;
 
 public class GemMetaAnalyzerTest {
 
     @Test
-    public void testAnalyzer() throws Exception {
+    public void testAnalyzerForTestUnit() throws Exception {
         Component component = new Component();
         component.setPurl(new PackageURL("pkg:gem/test-unit@3.2.0"));
 
@@ -35,7 +36,24 @@ public void testAnalyzer() throws Exception {
         Assert.assertTrue(analyzer.isApplicable(component));
         Assert.assertEquals(RepositoryType.GEM, analyzer.supportedRepositoryType());
         MetaModel metaModel = analyzer.analyze(component);
+        Assert.assertTrue(ComponentVersion.isStableVersion(metaModel.getLatestVersion()));
+        Assert.assertTrue(ComponentVersion.compareVersions("3.0.0", metaModel.getLatestVersion()) < 0);
+        Assert.assertNotNull(metaModel.getLatestVersion());
+        Assert.assertNotNull(metaModel.getPublishedTimestamp());
+    }
+
+    @Test
+    public void testAnalyzerForRails() throws Exception {
+        Component component = new Component();
+        component.setPurl(new PackageURL("pkg:gem/rails@3.2.0"));
+
+        GemMetaAnalyzer analyzer = new GemMetaAnalyzer();
+        Assert.assertTrue(analyzer.isApplicable(component));
+        Assert.assertEquals(RepositoryType.GEM, analyzer.supportedRepositoryType());
+        MetaModel metaModel = analyzer.analyze(component);
+        Assert.assertTrue(ComponentVersion.isStableVersion(metaModel.getLatestVersion()));
+        Assert.assertTrue(ComponentVersion.compareVersions("6.0.0", metaModel.getLatestVersion()) < 0);
         Assert.assertNotNull(metaModel.getLatestVersion());
-        //Assert.assertNotNull(metaModel.getPublishedTimestamp()); // todo: not yet supported
+        Assert.assertNotNull(metaModel.getPublishedTimestamp());
     }
 }
diff --git a/src/test/java/org/dependencytrack/tasks/repositories/GoModulesMetaAnalyzerTest.java b/src/test/java/org/dependencytrack/tasks/repositories/GoModulesMetaAnalyzerTest.java
index d49ff802ff..ed4c403b36 100644
--- a/src/test/java/org/dependencytrack/tasks/repositories/GoModulesMetaAnalyzerTest.java
+++ b/src/test/java/org/dependencytrack/tasks/repositories/GoModulesMetaAnalyzerTest.java
@@ -18,12 +18,13 @@
  */
 package org.dependencytrack.tasks.repositories;
 
-import com.github.packageurl.PackageURL;
 import org.dependencytrack.model.Component;
 import org.dependencytrack.model.RepositoryType;
 import org.junit.Assert;
 import org.junit.Test;
 
+import com.github.packageurl.PackageURL;
+
 public class GoModulesMetaAnalyzerTest {
 
     @Test
diff --git a/src/test/java/org/dependencytrack/tasks/repositories/HexMetaAnalyzerTest.java b/src/test/java/org/dependencytrack/tasks/repositories/HexMetaAnalyzerTest.java
index 2557a929af..42b5502b51 100644
--- a/src/test/java/org/dependencytrack/tasks/repositories/HexMetaAnalyzerTest.java
+++ b/src/test/java/org/dependencytrack/tasks/repositories/HexMetaAnalyzerTest.java
@@ -18,16 +18,17 @@
  */
 package org.dependencytrack.tasks.repositories;
 
-import com.github.packageurl.PackageURL;
 import org.dependencytrack.model.Component;
 import org.dependencytrack.model.RepositoryType;
+import org.dependencytrack.util.ComponentVersion;
 import org.junit.Assert;
 import org.junit.Test;
+import com.github.packageurl.PackageURL;
 
 public class HexMetaAnalyzerTest {
 
     @Test
-    public void testAnalyzer() throws Exception {
+    public void testAnalyzerForPhoenix() throws Exception {
         Component component = new Component();
         component.setPurl(new PackageURL("pkg:hex/phoenix@1.4.10"));
 
@@ -35,6 +36,23 @@ public void testAnalyzer() throws Exception {
         Assert.assertTrue(analyzer.isApplicable(component));
         Assert.assertEquals(RepositoryType.HEX, analyzer.supportedRepositoryType());
         MetaModel metaModel = analyzer.analyze(component);
+        Assert.assertTrue(ComponentVersion.isStableVersion(metaModel.getLatestVersion()));
+        Assert.assertTrue(ComponentVersion.compareVersions("1.6.15", metaModel.getLatestVersion()) < 0);
+        Assert.assertNotNull(metaModel.getLatestVersion());
+        Assert.assertNotNull(metaModel.getPublishedTimestamp());
+    }
+
+    @Test
+    public void testAnalyzerForPartisan() throws Exception {
+        Component component = new Component();
+        component.setPurl(new PackageURL("pkg:hex/partisan@1.4.10"));
+
+        HexMetaAnalyzer analyzer = new HexMetaAnalyzer();
+        Assert.assertTrue(analyzer.isApplicable(component));
+        Assert.assertEquals(RepositoryType.HEX, analyzer.supportedRepositoryType());
+        MetaModel metaModel = analyzer.analyze(component);
+        Assert.assertTrue(ComponentVersion.isStableVersion(metaModel.getLatestVersion()));
+        Assert.assertTrue(ComponentVersion.compareVersions("4.0.9", metaModel.getLatestVersion()) < 0);
         Assert.assertNotNull(metaModel.getLatestVersion());
         Assert.assertNotNull(metaModel.getPublishedTimestamp());
     }
diff --git a/src/test/java/org/dependencytrack/tasks/repositories/MavenMetaAnalyzerTest.java b/src/test/java/org/dependencytrack/tasks/repositories/MavenMetaAnalyzerTest.java
index 6ff5045135..95b623f4f2 100644
--- a/src/test/java/org/dependencytrack/tasks/repositories/MavenMetaAnalyzerTest.java
+++ b/src/test/java/org/dependencytrack/tasks/repositories/MavenMetaAnalyzerTest.java
@@ -18,16 +18,17 @@
  */
 package org.dependencytrack.tasks.repositories;
 
-import com.github.packageurl.PackageURL;
 import org.dependencytrack.model.Component;
 import org.dependencytrack.model.RepositoryType;
+import org.dependencytrack.util.ComponentVersion;
 import org.junit.Assert;
 import org.junit.Test;
+import com.github.packageurl.PackageURL;
 
 public class MavenMetaAnalyzerTest {
 
     @Test
-    public void testAnalyzer() throws Exception {
+    public void testAnalyzerForJUnit() throws Exception {
         Component component = new Component();
         component.setPurl(new PackageURL("pkg:maven/junit/junit@4.12"));
 
@@ -35,8 +36,23 @@ public void testAnalyzer() throws Exception {
         Assert.assertTrue(analyzer.isApplicable(component));
         Assert.assertEquals(RepositoryType.MAVEN, analyzer.supportedRepositoryType());
         MetaModel metaModel = analyzer.analyze(component);
-        Assert.assertNotNull(metaModel.getLatestVersion());
-        Assert.assertNotNull(metaModel.getPublishedTimestamp());
+        Assert.assertTrue(ComponentVersion.compareVersions("4.13.1", metaModel.getLatestVersion()) < 0);
+        Assert.assertTrue(ComponentVersion.isStableVersion(metaModel.getLatestVersion()));
+        // publishedTimestamp might be set or not
+    }
+
+    @Test
+    public void testAnalyzerForApacheCamel() throws Exception {
+        Component component = new Component();
+        component.setPurl(new PackageURL("pkg:maven/org.apache.camel/camel-core@2.21.2"));
+
+        MavenMetaAnalyzer analyzer = new MavenMetaAnalyzer();
+        Assert.assertTrue(analyzer.isApplicable(component));
+        Assert.assertEquals(RepositoryType.MAVEN, analyzer.supportedRepositoryType());
+        MetaModel metaModel = analyzer.analyze(component);
+        Assert.assertTrue(ComponentVersion.compareVersions("3.20.1", metaModel.getLatestVersion()) < 0);
+        Assert.assertTrue(ComponentVersion.isStableVersion(metaModel.getLatestVersion()));
+        // publishedTimestamp might be set or not
     }
 
     @Test
@@ -51,7 +67,9 @@ public void testAnalyzerForScalaComponent() throws Exception {
         Assert.assertTrue(analyzer.isApplicable(component));
         Assert.assertEquals(RepositoryType.MAVEN, analyzer.supportedRepositoryType());
         MetaModel metaModel = analyzer.analyze(component);
-        Assert.assertNotNull(metaModel.getLatestVersion());
-        Assert.assertNotNull(metaModel.getPublishedTimestamp());
+        Assert.assertTrue(ComponentVersion.compareVersions("2.6.0", metaModel.getLatestVersion()) < 0);
+        Assert.assertTrue(ComponentVersion.isStableVersion(metaModel.getLatestVersion()));
+        // publishedTimestamp might be set or not
     }
+
 }
diff --git a/src/test/java/org/dependencytrack/tasks/repositories/NpmMetaAnalyzerTest.java b/src/test/java/org/dependencytrack/tasks/repositories/NpmMetaAnalyzerTest.java
index a16856309f..46c4a2992b 100644
--- a/src/test/java/org/dependencytrack/tasks/repositories/NpmMetaAnalyzerTest.java
+++ b/src/test/java/org/dependencytrack/tasks/repositories/NpmMetaAnalyzerTest.java
@@ -18,11 +18,12 @@
  */
 package org.dependencytrack.tasks.repositories;
 
-import com.github.packageurl.PackageURL;
 import org.dependencytrack.model.Component;
 import org.dependencytrack.model.RepositoryType;
+import org.dependencytrack.util.ComponentVersion;
 import org.junit.Assert;
 import org.junit.Test;
+import com.github.packageurl.PackageURL;
 
 public class NpmMetaAnalyzerTest {
 
@@ -36,6 +37,7 @@ public void testAnalyzer() throws Exception {
         Assert.assertEquals(RepositoryType.NPM, analyzer.supportedRepositoryType());
         MetaModel metaModel = analyzer.analyze(component);
         Assert.assertNotNull(metaModel.getLatestVersion());
-        //Assert.assertNotNull(metaModel.getPublishedTimestamp()); // todo: not yet supported
+        Assert.assertTrue(ComponentVersion.compareVersions("2.7.0",metaModel.getLatestVersion()) < 0);
+        Assert.assertNull(metaModel.getPublishedTimestamp()); // NPM does not register publication dates
     }
 }
diff --git a/src/test/java/org/dependencytrack/tasks/repositories/NugetMetaAnalyzerTest.java b/src/test/java/org/dependencytrack/tasks/repositories/NugetMetaAnalyzerTest.java
index e01f2d55ed..4c919be52f 100644
--- a/src/test/java/org/dependencytrack/tasks/repositories/NugetMetaAnalyzerTest.java
+++ b/src/test/java/org/dependencytrack/tasks/repositories/NugetMetaAnalyzerTest.java
@@ -18,22 +18,21 @@
  */
 package org.dependencytrack.tasks.repositories;
 
-import com.github.packageurl.PackageURL;
+import static org.mockserver.model.HttpRequest.request;
+import static org.mockserver.model.HttpResponse.response;
+import java.nio.file.Files;
+import java.nio.file.Paths;
 import org.apache.http.HttpHeaders;
 import org.dependencytrack.model.Component;
 import org.dependencytrack.model.RepositoryType;
+import org.dependencytrack.util.ComponentVersion;
 import org.junit.AfterClass;
 import org.junit.Assert;
 import org.junit.BeforeClass;
 import org.junit.Test;
 import org.mockserver.client.MockServerClient;
 import org.mockserver.integration.ClientAndServer;
-
-import java.nio.file.Files;
-import java.nio.file.Paths;
-
-import static org.mockserver.model.HttpRequest.request;
-import static org.mockserver.model.HttpResponse.response;
+import com.github.packageurl.PackageURL;
 
 public class NugetMetaAnalyzerTest {
 
@@ -64,6 +63,26 @@ public void testAnalyzer() throws Exception {
         Assert.assertNotNull(metaModel.getPublishedTimestamp());
     }
 
+
+    @Test
+    public void testAnalyzerMicrosoftGraph() throws Exception {
+        Component component = new Component();
+        component.setPurl(new PackageURL("pkg:nuget/Microsoft.Graph@3.35.0"));
+
+        NugetMetaAnalyzer analyzer = new NugetMetaAnalyzer();
+
+        analyzer.setRepositoryBaseUrl("https://api.nuget.org");
+        MetaModel metaModel = analyzer.analyze(component);
+
+        Assert.assertTrue(analyzer.isApplicable(component));
+        Assert.assertEquals(RepositoryType.NUGET, analyzer.supportedRepositoryType());
+        Assert.assertFalse(metaModel.getLatestVersion().startsWith("5.0.0-preview"));
+        Assert.assertFalse(metaModel.getLatestVersion().startsWith("5.0.0-rc"));
+        Assert.assertTrue(ComponentVersion.compareVersions("4.0.0",metaModel.getLatestVersion()) < 0);
+        Assert.assertNotNull(metaModel.getLatestVersion());
+        Assert.assertNotNull(metaModel.getPublishedTimestamp());
+    }
+
     @Test
     public void testAnalyzerWithPrivatePackageRepository() throws Exception {
         String mockIndexResponse = readResourceFileToString("/unit/tasks/repositories/https---localhost-1080-v3-index.json");
diff --git a/src/test/java/org/dependencytrack/tasks/repositories/PypiMetaAnalyzerTest.java b/src/test/java/org/dependencytrack/tasks/repositories/PypiMetaAnalyzerTest.java
index 601a8841c1..2b1792ac3e 100644
--- a/src/test/java/org/dependencytrack/tasks/repositories/PypiMetaAnalyzerTest.java
+++ b/src/test/java/org/dependencytrack/tasks/repositories/PypiMetaAnalyzerTest.java
@@ -18,16 +18,17 @@
  */
 package org.dependencytrack.tasks.repositories;
 
-import com.github.packageurl.PackageURL;
 import org.dependencytrack.model.Component;
 import org.dependencytrack.model.RepositoryType;
+import org.dependencytrack.util.ComponentVersion;
 import org.junit.Assert;
 import org.junit.Test;
+import com.github.packageurl.PackageURL;
 
 public class PypiMetaAnalyzerTest {
 
     @Test
-    public void testAnalyzer() throws Exception {
+    public void testAnalyzerForFlask() throws Exception {
         Component component = new Component();
         component.setPurl(new PackageURL("pkg:pypi/Flask@1.0.0"));
 
@@ -35,6 +36,23 @@ public void testAnalyzer() throws Exception {
         Assert.assertTrue(analyzer.isApplicable(component));
         Assert.assertEquals(RepositoryType.PYPI, analyzer.supportedRepositoryType());
         MetaModel metaModel = analyzer.analyze(component);
+        Assert.assertTrue(ComponentVersion.isStableVersion(metaModel.getLatestVersion()));
+        Assert.assertTrue(ComponentVersion.compareVersions("2.2.2", metaModel.getLatestVersion()) < 0);
+        Assert.assertNotNull(metaModel.getLatestVersion());
+        Assert.assertNotNull(metaModel.getPublishedTimestamp());
+    }
+
+    @Test
+    public void testAnalyzerForNumPi() throws Exception {
+        Component component = new Component();
+        component.setPurl(new PackageURL("pkg:pypi/NumPi@1.0.0"));
+
+        PypiMetaAnalyzer analyzer = new PypiMetaAnalyzer();
+        Assert.assertTrue(analyzer.isApplicable(component));
+        Assert.assertEquals(RepositoryType.PYPI, analyzer.supportedRepositoryType());
+        MetaModel metaModel = analyzer.analyze(component);
+        Assert.assertTrue(ComponentVersion.isStableVersion(metaModel.getLatestVersion()));
+        Assert.assertTrue(metaModel.getLatestVersion().startsWith("0") || ComponentVersion.compareVersions("0.3.0", metaModel.getLatestVersion()) < 0); // 0 is considered unstable in SemVer
         Assert.assertNotNull(metaModel.getLatestVersion());
         Assert.assertNotNull(metaModel.getPublishedTimestamp());
     }
diff --git a/src/test/java/org/dependencytrack/util/ComponentVersionTest.java b/src/test/java/org/dependencytrack/util/ComponentVersionTest.java
new file mode 100644
index 0000000000..77c0406240
--- /dev/null
+++ b/src/test/java/org/dependencytrack/util/ComponentVersionTest.java
@@ -0,0 +1,519 @@
+/*
+ * This file is part of Dependency-Track.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ * Copyright (c) Steve Springett. All Rights Reserved.
+ */
+package org.dependencytrack.util;
+
+import junitparams.JUnitParamsRunner;
+import junitparams.Parameters;
+import org.junit.Assert;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import java.util.Arrays;
+import java.util.List;
+
+@RunWith(JUnitParamsRunner.class)
+public class ComponentVersionTest {
+
+    // versions to test, highest always comes first!
+    private Object[] paremetersVersions() {
+        return new Object[] {
+            new String[] { "2", "1" },
+            new String[] { "1", "1-snapshot" },
+            new String[] { "1_Final", "1" },
+            new String[] { "1.1_Final", "1.1" },
+            new String[] { "2-snapshot", "v1-snapshot" },
+            new String[] { "1.1-snapshot", "v1-snapshot" },
+            new String[] { "01.01-snapshot", "v1-snapshot" },
+            new String[] { "1", "1-next.1" }, // one might think next comes later, but only when denoted with ^ sign
+            new String[] { "1^next", "1-next.1" },
+            new String[] { "1.next", "1" },
+            new String[] { "1f.2g.3h.4i.5j.Release", "1a.2b.3c.4d.5e.Final" },
+            // new String[] { "1.0", "1" }, 1.0 and 1 are considered equal
+            new String[] { "2.0.1.Final-next", "v2.0.1.Final-snapshot" },
+            new String[] { "2.33-canary", "v2.33-snapshot" },
+            new String[] { "3.0-snapshot", "v2.1.Release-snapshot" },
+            new String[] { "3-snapshot", "v1.1-snapshot" },
+            new String[] { "3-snapshot", "v01.01-snapshot" },
+            new String[] { "v1", "1-alpha.1" },
+            new String[] { "v2", "1-next.1" },
+            new String[] { "2", "2-a" },
+            new String[] { "2a", "2-a" },
+            new String[] { "1.2a", "1.2" },
+            new String[] { "1.2.1", "1.2a.2" },
+            new String[] { "200180416", "200180413" },
+            new String[] { "200180416.1", "200180413.2" },
+            new String[] { "200180416", "200180416-beta" },
+            new String[] { "200180416.alpha", "200180416" }, // alpha is used as postrelease version here
+            // ~ operator: sort earlier
+            new String[] { "0.5.0", "0.5.0~earlier" },
+            new String[] { "0.5.0.earlier", "0.5.0~earlier" },
+            new String[] { "0.5.0-earlier", "0.5.0~earlier" },
+            new String[] { "0.5.0~earlier2", "0.5.0~earlier1" },
+            new String[] { "1", "1-earlier" },
+            // ^ operator: sort later
+            new String[] { "0.5.0^later", "0.5.0" },
+            new String[] { "0.5.0^later", "0.5.0-later" },
+            new String[] { "0.5.0^later2", "0.5.0^later1" },
+            // sort later
+            new String[] { "1.later", "1" },
+        };
+    }
+
+    @Test
+    @Parameters(method = "paremetersVersions")
+    public void testCompareVersions(String version1, String version2) {
+        Assert.assertTrue("not " + version1 + " > " + version2, ComponentVersion.compareVersions(version1, version2) > 0);
+        Assert.assertTrue("not " + version2 + " < " + version1, ComponentVersion.compareVersions(version2, version1) < 0);
+    }
+
+    @Test
+    @Parameters(method = "paremetersVersions")
+    public void testCompareVersionsEquals(String version1, String version2) {
+        Assert.assertEquals("1.0 == 1", 0, ComponentVersion.compareVersions("1.0", "1"));
+        Assert.assertEquals("1.0.0 == 1", 0, ComponentVersion.compareVersions("1.0.0", "1"));
+        Assert.assertEquals("1.0.0 == 1.0", 0, ComponentVersion.compareVersions("1.0.0", "1.0"));
+        Assert.assertEquals("1.0.0.0 == 1.0.0", 0, ComponentVersion.compareVersions("1.0.0.0", "1.0.0"));
+        Assert.assertEquals("1+mnu1 == 1+mnu2", 0, ComponentVersion.compareVersions("1+mnu1", "1+mnu2"));
+        Assert.assertEquals("1+git20221212 == 1+git20101212", 0, ComponentVersion.compareVersions("1+git20221212", "1+git20101212"));
+        Assert.assertEquals(version1, 0, ComponentVersion.compareVersions(version1, version1));
+        Assert.assertEquals(version2, 0, ComponentVersion.compareVersions(version2, version2));
+    }
+
+    @Test
+    public void testCompareVersionsNull() {
+        Assert.assertEquals(0, ComponentVersion.compareVersions(null, null));
+        Assert.assertEquals(0, ComponentVersion.compareVersions("", ""));
+        Assert.assertEquals(0, ComponentVersion.compareVersions(null, ""));
+        Assert.assertEquals(0, ComponentVersion.compareVersions("", null));
+        Assert.assertTrue(ComponentVersion.compareVersions("1", null) > 0);
+        Assert.assertTrue(ComponentVersion.compareVersions(null, "1") < 0);
+        Assert.assertTrue(ComponentVersion.compareVersions("1", "") > 0);
+        Assert.assertTrue(ComponentVersion.compareVersions("", "1") < 0);
+    }
+
+    private Object[] paremetersUbuntuVersions() {
+
+        return new Object[] {
+            new String[] { "2.0.1f", "2.0.1e" },
+            new String[] { "2.0.1f", "1.1.1fubuntu2.4" },
+            new String[] { "2.0.1fubuntu2.4", "2.0.1f" },
+            new String[] { "2.0.1fubuntu5", "2.0.1fubuntu2.4ppa1" },
+            new String[] { "2.0.1fubuntu5ppa1", "2.0.1fubuntu2.4ppa1" },
+            new String[] { "2.0.1fubuntu2.4ppa2", "2.0.1fubuntu2.4ppa1" },
+            new String[] { "2.0.1f-1", "1.1.1f-1ppa4" },
+            new String[] { "2.0.1f-1ubuntu2.4", "1.1.1f-1ubuntu2.4" },
+            new String[] { "1.1.1f-1ubuntu2.5", "1.1.1f-1ubuntu2.4" },
+            new String[] { "1.1.1g-1ubuntu2.4", "1.1.1f-1ubuntu2.4" },
+            new String[] { "4.9.1+nmu1ubuntu2", "4.9.0ubuntu2" },
+
+            // Ubuntu package myapp_1.0-1 < PPA package myapp_1.0-1ppa1
+            new String[] { "1.0-1ppa1", "1.0-1" },
+            // Ubuntu package myapp_1.0-1ubuntu3 < PPA package myapp_1.0-1ubuntu3ppa1
+            new String[] { "1.0-1ubuntu3ppa1", "1.0-1ubuntu3" },
+            new String[] { "1.0ppa2", "1.0ppa1" },
+            // Test epoch
+            new String[] { "2:v1", "1:v1" },
+            new String[] { "2:v1", "1:v2" },
+            new String[] { "2:v2", "1:v1" },
+            new String[] { "2:v2", "1:v2" },
+            new String[] { "3:v1", "2:v1" },
+            new String[] { "3:v1", "2:v2" },
+            new String[] { "3:v2", "2:v2" },
+            new String[] { "3:v2", "2:v1" },
+            new String[] { "1:9.11.3+dfsg-1ubuntu1.18", "9.11.3+dfsg-1ubuntu1.18" },
+            new String[] { "0.97-2build1", "0.97-1build10" },
+            new String[] { "0.12.2-1.3ubuntu0.3", "0.12.1-1.3ubuntu0.3" },
+            new String[] { "1.56.1", "1.56.1-1" },
+            new String[] { "2.56.4-0ubuntu1.18.04.9", "2.56.4-0ubuntu0.18.04.9" },
+            new String[] { "2:6.1.2+dfsg-2ubuntu0.1", "2:6.1.2+dfsg1-2ubuntu0.1" },
+            new String[] { "3.5.18ubuntu1.6", "3.5.18-1ubuntu1.6" },
+        };
+    }
+
+    private Object[] parametersDebianVersions() {
+
+        return new Object[] {
+            new String[] { "0.17-2", "0.17-1" },
+            new String[] { "0.18-0", "0.17-1" },
+            new String[] { "1.17-1", "0.17-1" },
+            new String[] { "2.1.6+deb1+cvs20081104-13.2", "2.1.5-13.2" },
+            new String[] { "2.1.5+deb2+cvs20081104-13.2", "2.1.5+deb1+cvs20081104-13.2" },
+            new String[] { "2.1.6+deb1+cvs20081204-13.2", "2.1.5+deb1+cvs20081104-13.2" },
+            new String[] { "5.6.0+git+20171128-2", "4.6.0+git+20171128-2" },
+            new String[] { "0.100.0-b21", "0.100.0-21" },
+            new String[] { "1:007-4build2", "1:007-4build1" },
+            new String[] { "1:1.0.10b", "1:1.0.10" },
+            new String[] { "1:1.0.10b-1", "1:1.0.10-1" },
+            new String[] { "3.0.11-dfsg-2", "3.0.11-dfsg-1" },
+            new String[] { "1:9.11.3+dfsg-1ubuntu2.18", "1:9.11.3+dfsg-1ubuntu1.18" },
+            new String[] { "4.9.39+dfsg.03-5", "4.9.39+dfsg.02-5" },
+            new String[] { "4.9.1+nmu1", "4.9.0+nmu1" },
+            new String[] { "1.1.1o-0+deb11u3", "1.1.1n-0+deb11u3" },
+            new String[] { "7.9-2+deb11u1", "7.8-2+deb11u1" },
+            new String[] { "1.2.16+ds2-2+deb11u1", "1.2.16+ds1-2+deb11u1" },
+            new String[] { "2.1.1d-13.3", "2.1.1d-13.2" },
+            new String[] { "2.1.1e-13.2", "2.1.1d-13.2" },
+        };
+
+    }
+
+    @Test
+    @Parameters(method = "paremetersUbuntuVersions")
+    public void testCompareUbuntuVersions(String version1, String version2) {
+        Assert.assertTrue("not " + version1 + " > " + version2, ComponentVersion.compareVersions(version1, version2) > 0);
+        Assert.assertTrue("not " + version2 + " < " + version1, ComponentVersion.compareVersions(version2, version1) < 0);
+    }
+
+    @Test
+    @Parameters(method = "parametersDebianVersions")
+    public void testCompareDebianVersions(String version1, String version2) {
+        Assert.assertTrue("not " + version1 + " > " + version2, ComponentVersion.compareVersions(version1, version2) > 0);
+        Assert.assertTrue("not " + version2 + " < " + version1, ComponentVersion.compareVersions(version2, version1) < 0);
+    }
+
+    @Test
+    @Parameters(method = "paremetersUbuntuVersions")
+    public void testCompareUbuntuVersionsEquals(String version1, String version2) {
+        Assert.assertEquals(version1, 0, ComponentVersion.compareVersions(version1, version1));
+        Assert.assertEquals(version2, 0, ComponentVersion.compareVersions(version2, version2));
+    }
+
+    @Test
+    @Parameters(method = "parametersDebianVersions")
+    public void testCompareDebianVersionsEquals(String version1, String version2) {
+        Assert.assertEquals(version1, 0, ComponentVersion.compareVersions(version1, version1));
+        Assert.assertEquals(version2, 0, ComponentVersion.compareVersions(version2, version2));
+    }
+
+    @Test
+    public void testCompareDebianVersionsBuilddata() {
+        Assert.assertEquals( 0, ComponentVersion.compareVersions("2.1.5+deb1+cvs20081104-14.2", "2.1.5+deb1+cvs20081104-13.2"));
+        Assert.assertEquals( 0, ComponentVersion.compareVersions("2.1.5+deb1+cvs20081104-13.3", "2.1.5+deb1+cvs20081104-13.2"));
+        Assert.assertEquals( 0, ComponentVersion.compareVersions("2.1.5+deb1+1", "2.1.5+deb1+2"));
+    }
+
+    @Test
+    public void testHighestVersionNull() {
+        Assert.assertNull(ComponentVersion.highestVersion(null, null));
+    }
+
+    @Parameters (method = "paremetersVersions")
+    public void testHighestVersion(String version1, String version2) {
+        Assert.assertEquals(version1, ComponentVersion.highestVersion(version1, version2));
+    }
+
+    @Parameters (method = "paremetersUbuntuVersions")
+    public void testHighestVersionUbuntu(String version1, String version2) {
+        Assert.assertEquals(version1, ComponentVersion.highestVersion(version1, version2));
+    }
+
+    @Parameters (method = "parametersDebianVersions")
+    public void testHighestVersionDebian(String version1, String version2) {
+        Assert.assertEquals(version1, ComponentVersion.highestVersion(version1, version2));
+    }
+
+    private Object[] paremetersSemVerVersions() {
+        return new Object[] {
+            // Stable:
+            new String[] { "1.0.0" },
+            new String[] { "9.3.0-Final" },
+            new String[] { "4.22.0+4e01e86b5fc27661dd585946578d0625dd4af38d" },
+            new String[] { "1.0.1-0+20130313144700" },
+            new String[] { "4.22.0-b.e.t.a.1+4e01e86.b5fc27-.-661dd5.85946.578d0--625dd4af38d.1a-as1w2" },
+            // Unstable:
+            new String[] { "1.11.0-1.1" },
+            new String[] { "1.2.0-4" },
+            new String[] { "2.1.2-2.1" },
+            new String[] { "2.2.12-1.1" },
+            new String[] { "1.22.333-rc1" },
+            new String[] { "9.3.0-BETA.14-77e850b" },
+            new String[] { "3.10.0-canary.1" },
+            new String[] { "31.0.0-next.1" },
+            new String[] { "4.22.0-next.1627591352.4e01e86b5fc27661dd585946578d0625dd4af38d" },
+            // 9. A pre-release version MAY be denoted by appending a hyphen and a series of dot separated
+            // identifiers immediately following the patch version. Identifiers MUST comprise only ASCII
+            // alphanumerics and hyphens [0-9A-Za-z-]. Identifiers MUST NOT be empty. Numeric identifiers
+            // MUST NOT include leading zeroes. Pre-release versions have a lower precedence than the
+            // associated normal version. A pre-release version indicates that the version is unstable
+            // and might not satisfy the intended compatibility requirements as denoted by its associated
+            // normal version. Examples: 1.0.0-alpha, 1.0.0-alpha.1, 1.0.0-0.3.7, 1.0.0-x.7.z.92, 1.0.0-x-y-z.--.
+            // (semver.org)
+            new String[] { "1.10.0-alpha" },
+            new String[] { "1.0.10-alpha.1" },
+            new String[] { "1.0.0-0.3.7" },
+            new String[] { "1.0.0-x.7.z.92" },
+            new String[] { "1.0.0-x-y-z.--" },
+            // 10. Build metadata MAY be denoted by appending a plus sign and a series of dot separated
+            // identifiers immediately following the patch or pre-release version. Identifiers MUST
+            // comprise only ASCII alphanumerics and hyphens [0-9A-Za-z-]. Identifiers MUST NOT be empty.
+            // Build metadata MUST be ignored when determining version precedence. Thus two versions that
+            // differ only in the build metadata, have the same precedence. Examples: 1.0.0-alpha+001,
+            // 1.0.0+20130313144700, 1.0.0-beta+exp.sha.5114f85, 1.0.0+21AF26D3----117B344092BD.
+            // (semver.org)
+            new String[] { "4.22.0-beta+4e01e86b5fc27661dd585946578d0625dd4af38d-final" },
+            new String[] { "11.1.0-alpha+001" },
+            new String[] { "1.0.0-beta+exp.sha.5114f85" },
+            new String[] { "0.2.2-beta2+git20190406.ef77f01" },
+
+            new String[] { "2.5.1-develop-0017" },
+            new String[] { "1.0.0-1.develop09" },
+            new String[] { "1.0.0-feat-name09" },
+            new String[] { "2.5.1-develop-0017" },
+            new String[] { "0.0.4" },
+            new String[] { "1.2.3" },
+            new String[] { "10.20.30" },
+            new String[] { "1.1.2-prerelease+meta" },
+            new String[] { "1.1.2+meta" },
+            new String[] { "1.1.2+meta-valid" },
+            new String[] { "1.0.0-alpha" },
+            new String[] { "1.0.0-beta" },
+            new String[] { "1.0.0-alpha.beta" },
+            new String[] { "1.0.0-alpha.beta.1" },
+            new String[] { "1.0.0-alpha.1" },
+            new String[] { "1.0.0-alpha0.valid" },
+            new String[] { "1.0.0-alpha.0valid" },
+            new String[] { "1.0.0-alpha-a.b-c-somethinglong+build.1-aef.1-its-okay" },
+            new String[] { "1.0.0-rc.1+build.1" },
+            new String[] { "2.0.0-rc.1+build.123" },
+            new String[] { "1.2.3-beta" },
+            new String[] { "10.2.3-DEV-SNAPSHOT" },
+            new String[] { "1.2.3-SNAPSHOT-123" },
+            new String[] { "1.0.0" },
+            new String[] { "2.0.0" },
+            new String[] { "1.1.7" },
+            new String[] { "2.0.0+build.1848" },
+            new String[] { "2.0.1-alpha.1227" },
+            new String[] { "1.0.0-alpha+beta" },
+            new String[] { "1.2.3----RC-SNAPSHOT.12.9.1--.12+788" },
+            new String[] { "1.2.3----R-S.12.9.1--.12+meta" },
+            new String[] { "1.2.3----RC-SNAPSHOT.12.9.1--.12" },
+            new String[] { "1.0.0+0.build.1-rc.10000aaa-kk-0.1" },
+            new String[] { "99999999999999999999999.999999999999999999.99999999999999999" },
+            new String[] { "1.0.0-0A.is.legal" },
+
+        };
+    }
+
+    private Object[] paremetersNotSemVerVersions() {
+        return new Object[] {
+            new String[] { "1.0" },
+            new String[] { "1.0.1.0" },
+            new String[] { "version1" },
+            new String[] { "01" },
+            new String[] { "9.3.0.Final" },
+            new String[] { "1.0.1.0+20130313144700" },
+        };
+    }
+
+    @Test
+    @Parameters(method = "paremetersSemVerVersions")
+    public void testIsSemVer(String version) {
+        Assert.assertTrue("not semver: " + version, ComponentVersion.isSemVer(version));
+    }
+
+    @Test
+    @Parameters(method = "paremetersNotSemVerVersions")
+    public void testIsNotSemVerVersion(String version) {
+        Assert.assertFalse("is semver: " + version, ComponentVersion.isSemVer(version));
+    }
+
+    private Object[] paremetersStableVersions() {
+        return new Object[] {
+            // Stable:
+            new String[] { "2.0.1f" },
+            new String[] { "1" },
+            new String[] { "1.0" },
+            new String[] { "1.0.0" },
+            new String[] { "1.0.0" },
+            new String[] { "1a" },
+            new String[] { "9.3.0.Final" },
+            new String[] { "9.3.0.RELEASE" },
+            new String[] { "4.22.0+4e01e86b5fc27661dd585946578d0625dd4af38d" },
+            // semver doesn't allow leading zero's but it doesn't hurt:
+            new String[] { "01.002.0003" },
+            new String[] { "1.0.1.0+20130313144700" },
+            new String[] { "1.0.0+21AF26D3----117B344092BD" },
+            // ubuntu package versions, see https://github.com/DependencyTrack/dependency-track/issues/1374
+            new String[] { "1.1.1f-1ubuntu2.4" },
+            new String[] { "0.18ubuntu0.18.04.1" },
+            new String[] { "0.37ubuntu0.15" },
+            new String[] { "2:1.02.145-4.1ubuntu3.18.04.3" },
+            new String[] { "2:1.02.145-4.1ubuntu3.18.04.3" },
+            new String[] { "3.1-1ubuntu0.1" },
+            new String[] { "2018013001" },
+            new String[] { "2018013001" },
+            // debian
+            new String[] { "1.1.1n-0+deb11u3" },
+            new String[] { "4.9.39+dfsg.02-5" },
+            new String[] { "2.2+git20080214.600fc29+dfsg-2" },
+            new String[] { "7.8-2+deb11u1" },
+            new String[] { "1.4.0~dfsg+~1.4.5-2" },
+            new String[] { "1.2.16+ds1-2+deb11u1" },
+            // Semver:
+            new String[] { "1.1.2+meta" },
+            new String[] { "1.1.2+meta-valid" },
+            new String[] { "2.0.0+build.1848" },
+            new String[] { "1.0.0+0.build.1-rc.10000aaa-kk-0.1" },
+        };
+    }
+
+    private Object[] paremetersUnstableVersions() {
+        return new Object[] {
+            // Unstable:
+            new String[] { "1.11.0-1.1" },
+            new String[] { "1.2.0-4" },
+            new String[] { "2.1.2-2.1" },
+            new String[] { "2.2.12-1.1" },
+            new String[] { "2.1.1d-13.2" },
+            new String[] { "version" },
+            new String[] { "1-A" },
+            new String[] { "1-alpha" },
+            new String[] { "1-b" },
+            new String[] { "11.1-SNApshot" },
+            new String[] { "1.22.333-rc1" },
+            new String[] { "9.3.0-BETA.14-77e850b" },
+            new String[] { "3.10.0-canary.1" },
+            new String[] { "31.0.0-next.1" },
+            // semver doesn't allow leading zero's but it doesn't hurt:
+            new String[] { "01.002.0003-snapshot" },
+            new String[] { "4.22.0-next.1627591352.4e01e86b5fc27661dd585946578d0625dd4af38d" },
+            // 9. A pre-release version MAY be denoted by appending a hyphen and a series of dot separated
+            // identifiers immediately following the patch version. Identifiers MUST comprise only ASCII
+            // alphanumerics and hyphens [0-9A-Za-z-]. Identifiers MUST NOT be empty. Numeric identifiers
+            // MUST NOT include leading zeroes. Pre-release versions have a lower precedence than the
+            // associated normal version. A pre-release version indicates that the version is unstable
+            // and might not satisfy the intended compatibility requirements as denoted by its associated
+            // normal version. Examples: 1.0.0-alpha, 1.0.0-alpha.1, 1.0.0-0.3.7, 1.0.0-x.7.z.92, 1.0.0-x-y-z.--.
+            // (semver.org)
+            new String[] { "1.10.0-alpha" },
+            new String[] { "1.0.10-alpha.1" },
+            new String[] { "1.0.0-0.3.7" },
+            new String[] { "1.0.0-x.7.z.92" },
+            new String[] { "11.10.0-x-y-z.--." },
+            // 10. Build metadata MAY be denoted by appending a plus sign and a series of dot separated
+            // identifiers immediately following the patch or pre-release version. Identifiers MUST
+            // comprise only ASCII alphanumerics and hyphens [0-9A-Za-z-]. Identifiers MUST NOT be empty.
+            // Build metadata MUST be ignored when determining version precedence. Thus two versions that
+            // differ only in the build metadata, have the same precedence. Examples: 1.0.0-alpha+001,
+            // 1.0.0+20130313144700, 1.0.0-beta+exp.sha.5114f85, 1.0.0+21AF26D3----117B344092BD.
+            // (semver.org)
+            new String[] { "11.1.0-alpha+001" },
+            new String[] { "1.0.0-beta+exp.sha.5114f85" },
+            new String[] { "0.2.2-beta2+git20190406.ef77f01-3+b1" },
+            new String[] { "2.0.1-alpha.1227" },
+            new String[] { "1.0.0-alpha+beta" },
+            new String[] { "1.2.3----RC-SNAPSHOT.12.9.1--.12+788" },
+            new String[] { "1.2.3----R-S.12.9.1--.12+meta" },
+            new String[] { "1.2.3----RC-SNAPSHOT.12.9.1--.12" },
+            // non-semver
+            new String[] { "0.0.0-develop.09" },
+            new String[] { "0.0.0-feat-name.09" },
+        };
+    }
+
+    @Test
+    @Parameters(method = "paremetersStableVersions")
+    public void testIsStableVersion(String version) {
+        Assert.assertTrue("not stable: " + version, ComponentVersion.isStableVersion(version));
+    }
+
+    @Test
+    @Parameters(method = "paremetersUnstableVersions")
+    public void testIsUntableVersion(String version) {
+        Assert.assertFalse("not unstable: " + version, ComponentVersion.isStableVersion(version));
+    }
+
+    private Object[] highestStableOrUnstableVersionParams() {
+        return new Object[] {
+            new Object[] { "2", Arrays.asList("1", "2", "2-snapshot") },
+            new Object[] { "1", Arrays.asList("1") },
+            new Object[] { "2-snapshot", Arrays.asList("1", "2-snapshot") },
+            new Object[] { "2", Arrays.asList("1", "2") },
+            new Object[] { "2", Arrays.asList("1", "2", "2-alpha") },
+            new Object[] { "2", Arrays.asList("1", "2", "2-beta") },
+            new Object[] { "2", Arrays.asList("1", "2", "2-rc1") },
+            new Object[] { "9.3.0-beta.14-77e850b", Arrays.asList("9.2.3", "9.3.0-beta.14-77e850b") },
+            new Object[] { "v1", Arrays.asList("v1") },
+            new Object[] { "v2-snapshot", Arrays.asList("1", "v2-snapshot") },
+            new Object[] { "2", Arrays.asList("v1", "2") },
+            new Object[] { "v2", Arrays.asList("v1", "v2") },
+            new Object[] { "v2", Arrays.asList("1", "v2") },
+        };
+    }
+
+    @Test
+    @Parameters(method = "highestStableOrUnstableVersionParams")
+    public void testfindHighestStableOrUnstableVersion(String highestVersion, List<String> list) {
+        Assert.assertNull(ComponentVersion.findHighestStableOrUnstableVersion(Arrays.asList()));
+        Assert.assertEquals(highestVersion, ComponentVersion.findHighestStableOrUnstableVersion(list));
+    }
+
+    private Object[] highestStableVersionParams() {
+        return new Object[] {
+            new Object[] { "1", Arrays.asList("1") },
+            new Object[] { "1", Arrays.asList("1", "0.9.9") },
+            new Object[] { "1", Arrays.asList("1", "2-snapshot") },
+            new Object[] { "1", Arrays.asList("1", "2-rc1") },
+            new Object[] { "1", Arrays.asList("1", "2-alpha") },
+            new Object[] { "1", Arrays.asList("1", "2-m1") },
+            new Object[] { "2.0", Arrays.asList("1.2.3", "2.0") },
+            new Object[] { "2", Arrays.asList("1", "2", "2-snapshot") },
+            new Object[] { "2", Arrays.asList("1", "2", "2-a") },
+            new Object[] { "v2", Arrays.asList("1", "v2", "2-alpha") },
+            new Object[] { "2", Arrays.asList("v1", "2", "2-beta") },
+            new Object[] { "2", Arrays.asList("v1", "2", "v2-rc1") },
+            new Object[] { "9.2.3", Arrays.asList("9.2.3", "9.3.0-beta.14-77e850b") },
+        };
+    }
+
+    @Test
+    @Parameters(method = "highestStableVersionParams")
+    public void testfindHighestStableVersion(String highestVersion, List<String> list) {
+        Assert.assertNull(ComponentVersion.findHighestStableVersion(Arrays.asList()));
+        Assert.assertNull(ComponentVersion.findHighestStableVersion(Arrays.asList("1-a", "2-snapshot", "2-rc1")));
+        Assert.assertEquals(highestVersion, ComponentVersion.findHighestStableVersion(list));
+    }
+
+    private Object[] highestVersionParams() {
+        return new Object[] {
+            new Object[] {"1", Arrays.asList("1") },
+            new Object[] {"1", Arrays.asList("1", "0.9.9") },
+            new Object[] {"1", Arrays.asList("1", "2-snapshot") },
+            new Object[] {"2-snapshot", Arrays.asList("1-snapshot", "2-snapshot") },
+            new Object[] {"1", Arrays.asList("1", "2-rc1") },
+            new Object[] {"1", Arrays.asList("1", "2-alpha") },
+            new Object[] {"1", Arrays.asList("1", "2-m1") },
+            new Object[] {"2.0", Arrays.asList("1.2.3", "2.0") },
+            new Object[] {"2", Arrays.asList("1", "2", "2-snapshot") },
+            new Object[] {"2", Arrays.asList("1", "2", "2-a") },
+            new Object[] {"2", Arrays.asList("1", "2", "2-alpha") },
+            new Object[] {"2", Arrays.asList("1", "2", "2-beta") },
+            new Object[] {"2", Arrays.asList("1", "2", "2-rc1") },
+            // N.B. 2.rc1 would be a better choise than 2-snapshot :-(
+            new Object[] {"2-snapshot", Arrays.asList("1-a", "2-snapshot", "2-rc1") },
+        };
+    }
+
+    @Test
+    @Parameters(method = "highestVersionParams")
+    public void testfindHighestVersion(String highestVersion, List<String> list) {
+        Assert.assertNull(ComponentVersion.findHighestVersion(Arrays.asList()));
+        Assert.assertEquals(highestVersion, ComponentVersion.findHighestVersion(list));
+    }
+
+}
\ No newline at end of file