Ignore Pre-Release NuGet Packages

[witchdr]

Is there a way to get Dependency Track to ignore pre-release NuGet versions? For instance, I'm getting a warning in the Components list because I'm not using Azure.Storage.Blobs v12.9.0- beta.3, but I wouldn't want to use a Beta version in my production code. The current, latest, released version is v12.8.3.

[stevespringett]

DT will query NuGet to determine the latest version. A query like this is made:
https://api.nuget.org/v3-flatcontainer/Azure.Storage.Blobs/index.json

DT will then query the individual package with a query such as:
https://api.nuget.org/v3/registration3/azure.storage.blobs/12.9.0-beta.3.json

NuGet is notorious for having incomplete data on packages. Both of these fail with a 404
https://api.nuget.org/v3/registration3/azure.storage.blobs/12.9.0-beta.3.json
https://api.nuget.org/v3/registration3/azure.storage.blobs/12.8.3.json

However, an older version of the same library works:
https://api.nuget.org/v3/registration3/azure.storage.blobs/12.2.0.json

Ideally, Microsoft would fix NuGet and add a prerelease flag to snapshot, alpha, and beta packages. Short of Microsoft fixing NuGet and adding a prerelease flag, the only thing that could be done is to make each repository configurable with patterns to exclude.

This is not currently supported by DT, but could be added. PRs are welcome.

[witchdr]

Thanks for taking a look.

According to https://docs.microsoft.com/en-us/nuget/concepts/package-versioning#pre-release-versions, pre-release versions are designated by convention. If you add a - (dash) and any words to the version number it is considered pre-release.

I'll take a look at the PR.

[brentos99]

I hadn't seen any movement on this for a while so I created an Issue #3467 and a PR #3468.