As @tschmidtb51 pointed out [here](https://github.com/secvisogram/csaf-validator-service/pull/4#discussion_r844019401). The versioning of the service should probably be part of an automated release process.