Package URL and Version range spec

" summary

Explains Package URL (purl) for identifying packages across ecosystems and introduces the new "vers" Version Range Specifier for expressing version constraints. Describes using purl plus vers to represent package identity, dependency requirements (e.g., ">=2.0") and vulnerable affected version sets, with the goal of enabling mostly universal dependency resolvers and installers that work across multiple package ecosystems.

AI-written summary · about

" related talks

• 37mPackages and versioningMartijn Harthoorn · HL7 FHIR DevDays 2019 Redmond
• 05mComparing Package Versions with DiffifyColin S Gillespie · rstudio::conf 2019
• 28mPolicy as [versioned] Code - you're doing it wrongChris Nesbitt-Smith · Docker Community All-Hands #6
• 43mManaging multiple versionsGrahame Grieve · HL7 FHIR DevDays 2019 Redmond
• 57mZen and the Art of Package ManagementYehuda Katz · RubyConf Portugal 2016
• 36mThe future of dependency management, seen from 2022Louis CAD · droidcon Berlin 2022
• 05mComparing Package Versions with DiffifyColin S Gillespie · rstudio::conf(2022)
• 30mBreaking backwards compatibility: The easy way!Flavio Percoco · PyCon Australia 2015