diff --git a/lib/datasource/github.js b/lib/datasource/github.js
index 1b2193ac8440920a489db5afa3174d241628b801..73630844739d8deb45cd8f7ef83d0f53cab93df0 100644
--- a/lib/datasource/github.js
+++ b/lib/datasource/github.js
@@ -1,11 +1,12 @@
 const ghGot = require('../platform/github/gh-got-wrapper');
-const { isVersion } = require('../versioning/semver');
+const versioning = require('../versioning');
 
 module.exports = {
   getDependency,
 };
 
-async function getDependency(purl) {
+async function getDependency(purl, config) {
+  const { versionScheme } = config || {};
   const { fullname: repo, qualifiers: options } = purl;
   let versions;
   let endpoint;
@@ -46,8 +47,12 @@ async function getDependency(purl) {
     return null;
   }
   // Filter by semver if no versionScheme provided
+  const { isVersion, sortVersions } = versioning(versionScheme);
+  // Return a sorted list of valid Versions
+  versions = versions.filter(isVersion).sort(sortVersions);
+  // Return sanitized versions (e.g. without leading 'v') if configured
   if (options.sanitize === 'true') {
-    versions = versions.map(version => isVersion(version)).filter(Boolean);
+    versions = versions.map(isVersion);
   }
   const dependency = {
     repositoryUrl: 'https://github.com/' + repo,
diff --git a/lib/datasource/npm.js b/lib/datasource/npm.js
index 2c287699aa427974df4d5b960a51f4fff1b23d1e..3646ed074c1f9865a369f85361902e01614aba37 100644
--- a/lib/datasource/npm.js
+++ b/lib/datasource/npm.js
@@ -8,6 +8,7 @@ const getRegistryUrl = require('registry-auth-token/registry-url');
 const registryAuthToken = require('registry-auth-token');
 const parse = require('github-url-from-git');
 const { isBase64 } = require('validator');
+const { isVersion, sortVersions } = require('../versioning')('semver');
 
 module.exports = {
   maskToken,
@@ -185,18 +186,21 @@ async function getDependencyInner(name, retries = 5) {
       homepage: res.homepage,
       latestVersion: res['dist-tags'].latest,
       repositoryUrl,
-      versions: res.versions,
+      versions: {},
       'dist-tags': res['dist-tags'],
       'renovate-config': latestVersion['renovate-config'],
     };
-    Object.keys(dep.versions).forEach(version => {
-      const v = {};
-      if (res.time && res.time[version]) {
-        v.time = res.time[version];
-        v.canBeUnpublished = moment().diff(moment(v.time), 'days') === 0;
-      }
-      dep.versions[version] = v;
-    });
+    Object.keys(res.versions)
+      .filter(isVersion)
+      .sort(sortVersions)
+      .forEach(version => {
+        const v = {};
+        if (res.time && res.time[version]) {
+          v.time = res.time[version];
+          v.canBeUnpublished = moment().diff(moment(v.time), 'days') === 0;
+        }
+        dep.versions[version] = v;
+      });
     logger.trace({ dep }, 'dep');
     memcache[name] = dep;
     return dep;
diff --git a/lib/datasource/packagist.js b/lib/datasource/packagist.js
index 79f49b2e704634f05f9d14ebfd56b7b83d6c75fc..22c2f83cf68efc6abc2e489cd86a0570bb334b76 100644
--- a/lib/datasource/packagist.js
+++ b/lib/datasource/packagist.js
@@ -1,7 +1,7 @@
 const URL = require('url');
 const got = require('got');
 const parse = require('github-url-from-git');
-const semver = require('semver');
+const { isVersion, sortVersions } = require('../versioning')('semver');
 
 module.exports = {
   getDependency,
@@ -32,13 +32,15 @@ async function getDependency(purl) {
     }
 
     Object.keys(res.versions)
-      .filter(version => semver.valid(version))
+      .filter(isVersion)
+      .sort(sortVersions)
       .forEach(version => {
-        const release = res.versions[version];
-        dep.homepage = dep.homepage || release.homepage;
-        dep.versions[semver.valid(version)] = {
+        const v = res.versions[version];
+        dep.homepage = dep.homepage || v.homepage;
+        const sanitize = isVersion;
+        dep.versions[sanitize(version)] = {
           gitHead: version,
-          time: release.time,
+          time: v.time,
         };
       });
     dep.homepage = dep.homepage || res.repository;
diff --git a/lib/datasource/pypi.js b/lib/datasource/pypi.js
index b9a2f1c270e85e03b76878e45172be3af18f38b0..877c07820a27050d08838d004724a8ac7cae3428 100644
--- a/lib/datasource/pypi.js
+++ b/lib/datasource/pypi.js
@@ -1,4 +1,5 @@
 const got = require('got');
+const { isVersion, sortVersions } = require('../versioning')('semver');
 
 module.exports = {
   getDependency,
@@ -25,11 +26,14 @@ async function getDependency(purl) {
     }
     dependency.versions = {};
     if (dep.releases) {
-      Object.keys(dep.releases).forEach(release => {
-        dependency.versions[release] = {
-          date: (dep.releases[release][0] || {}).upload_time,
-        };
-      });
+      Object.keys(dep.releases)
+        .filter(isVersion)
+        .sort(sortVersions)
+        .forEach(release => {
+          dependency.versions[release] = {
+            date: (dep.releases[release][0] || {}).upload_time,
+          };
+        });
     }
     return dependency;
   } catch (err) {
diff --git a/test/datasource/__snapshots__/github.spec.js.snap b/test/datasource/__snapshots__/github.spec.js.snap
index 88f6361ed12e7ec99a66aebb273fb0a301a2055a..ecd57d7b77d368befaf694221cd807eac1467ae4 100644
--- a/test/datasource/__snapshots__/github.spec.js.snap
+++ b/test/datasource/__snapshots__/github.spec.js.snap
@@ -15,8 +15,6 @@ Object {
   "repositoryUrl": "https://github.com/some/dep",
   "versions": Object {
     "1.0.0": Object {},
-    "a": Object {},
-    "v": Object {},
     "v1.1.0": Object {},
   },
 }
diff --git a/test/datasource/github.spec.js b/test/datasource/github.spec.js
index b89231ffa59af8b58a0be0db6a3c3920f3669d4b..a173731d2aae10cd0f45d4a36605d4f5664da565 100644
--- a/test/datasource/github.spec.js
+++ b/test/datasource/github.spec.js
@@ -33,7 +33,7 @@ describe('datasource/github', () => {
         'pkg:github/some/dep?ref=release'
       );
       expect(res).toMatchSnapshot();
-      expect(Object.keys(res.versions)).toHaveLength(4);
+      expect(Object.keys(res.versions)).toHaveLength(2);
       expect(res.versions['v1.1.0']).toBeDefined();
     });
     it('returns null for invalid ref', async () => {