Clarification on VERS usage in purl #816
Vishnu-2810
started this conversation in
General
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
I’d like to clarify the purpose of vers. Is it intended only for specifying vulnerability version ranges, or can it also be used within a purl? Additionally, can a version range be included in a purl?
All these purls have the same hash bf6d0a61364c692866a5bb728ac4369fe6ab8751
Maven link : https://mvnrepository.com/artifact/androidx.databinding/databinding-compiler/8.4.0-alpha11
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha04?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha05?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha06?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha07?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha08?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha09?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha10?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha11?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha12?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-alpha13?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-beta01?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-beta02?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-rc01?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0-rc02?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.0?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.1?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.4.2?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-alpha01?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-alpha02?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-alpha03?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-alpha04?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-alpha06?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-alpha07?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-alpha08?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-beta01?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-beta02?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-rc01?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0-rc02?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.0?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.1?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.5.2?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.6.0-alpha01?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.6.0-alpha02?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.6.0-alpha03?type=jar
pkg:maven/androidx.databinding/databinding-compiler@8.6.0-alpha04?type=jar
please check the maven repository also it has the same hash for all these versions because these are android dependencies .In such cases how to specify multiple purls for a component
If it is not possible to add vers range in purl how to handle multiple purls for the same hash of a component, How can I list the purl entries?
If possible how vers can be specified in purl?
Thanks in advance @stevespringett
Beta Was this translation helpful? Give feedback.
All reactions