Clarification on VERS

[Vishnu-2810]

We’d like to clarify the purpose of vers. Is it intended only for specifying vulnerability version ranges, or can it also be used within a purl? Additionally, can a version range be included in a purl?

All these purls have the same hash bf6d0a61364c692866a5bb728ac4369fe6ab8751

Maven link : https://mvnrepository.com/artifact/androidx.databinding/databinding-compiler/8.4.0-alpha11

pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha04?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha05?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha06?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha07?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha08?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha09?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha10?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha11?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha12?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha13?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-beta01?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-beta02?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-rc01?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-rc02?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.1?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.2?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-alpha01?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-alpha02?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-alpha03?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-alpha04?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-alpha06?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-alpha07?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-alpha08?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-beta01?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-beta02?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-rc01?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-rc02?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.1?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.2?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.6.0-alpha01?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.6.0-alpha02?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.6.0-alpha03?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.6.0-alpha04?type=jar

If it is not possible to add vers range in purl how to handle multiple purls for the same hash of a component, How can I list the purl entries?

If possible how vers can be specified in purl?

Thanks in advance @stevespringett @jkowalleck Please provide clarification on this

[jkowalleck]

Additionally, can a version range be included in a purl?

PURL is subject of the other project: https://github.com/package-url
for purl questions, ask here: https://github.com/package-url/purl-spec/discussions/categories/q-a

PS: here is the answer - https://github.com/package-url/purl-spec/blob/5d9516cc661e77a88cf33fadc057d18df963ff3c/docs/common-qualifiers.md?plain=1#L36-L44