Strict SemVer is still quite rare but most projects are "close" to it. I've only followed it loosely with FW/1 but it wouldn't hurt me to be a bit more "standard". For example, I tend to omit .Z if it is zero (which I shouldn't) and I tend to use -alpha1 instead of -alpha.1, but I've generally rev'd X for breaking API changes, Y for backward compatible additions (and bug fixes), and Z for just bug fixes.
In the Clojure world, a lot of projects are still 0.Y.Z even tho' their APIs are fairly stable: there's a sense that 1.0.0 is A Big Deal(tm) and so revving Y tends to indicate API changes. That's why the Clojure language is only up to 1.7.0-alpha2 even after seven years and all of the "official" contrib libraries are still at 0.Y.Z!
Since build metadata (following the +) isn't considered for version precedence, perhaps 4.0.0-rc.2 would be more appropriate? Or is this just the second build of your first RC?
I agree that as the use of CommandBox increases, following proper SemVer will become much more important in the CFML world.
Sean Corfield -- (904) 302-SEAN
An Architect's View --
http://corfield.org/"Perfection is the enemy of the good."
-- Gustave Flaubert, French realist novelist (1821-1880)