Allow optional version parameter in media-type

[ryanmoran]

The current media-type definition specifies that there are no optional parameters. This makes hinting the specification versions supported by an API difficult. Instead of being able to specify a precise spec version in an Accept header, we'd need to provide documentation elsewhere.

It would be great if the IANA media-type specification could be updated to allow for an optional version field that would correspond to the SPDX spec version. For example, application/spdx+json;version=2.2.

There are other SBOM format types that already support this type of parameter:

• CycloneDX
• Syft

[kestewart]

Not tied to the 2.3 release, so moving this forward for consideration.

[goneall]

Moving to the 3.1 milestone.

cc: @rnjudge