Which repo to link?

[tschmidtb51]

I currently see VERS in two repos:

1. https://github.com/package-url/purl-spec/blob/main/VERSION-RANGE-SPEC.rst
2. https://github.com/package-url/vers-spec/blob/main/VERSION-RANGE-SPEC.rst

I want to link to it: Which repo should I use?

Flagging @pombredanne

[mjherzog]

@tschmidtb51 You should use the vers-spec repo for this but VERSION-RANGE-SPEC.rst will also be obsolete in the near future so it would be better to refer to the vers-spec repo rather than this file. As we set up for Ecma standardization in Q4-2025/Q1-2026, the content of VERSION-RANGE-SPEC.rst file will be split into multiple markdown files as we have recently done for purl-spec.
We will keep the file itself in both repos for at least the remainder of 2025, but the content will be a redirect to the corresponding new documentation.

[tschmidtb51]

@mjherzog Thank you for the fast reply.

[rjb4standards]

Does anyone know of any plans to support the VERSION-RANGE-SPEC within the NIST NVD or other CVE reporting platform search functions, i.e. EUVD? I'm hoping to be able to search these vulnerability databases across multiple versions, i.e. show my all the CVE's for Version 5.0.0 to 7.0.0 of Product P.

[pombredanne]

@rjb4standards re:

Does anyone know of any plans to support the VERSION-RANGE-SPEC within the NIST NVD or other CVE reporting platform search functions, i.e. EUVD? I'm hoping to be able to search these vulnerability databases across multiple versions, i.e. show my all the CVE's for Version 5.0.0 to 7.0.0 of Product P.

It would be awesome. CVE just merged support for PURL with:

• RFD: Support for Package URLs CVEProject/cve-schema#407
  ... and I did not wanted to throw a money wrench to slow them down with VERS.

The obvious next step would be for them to adopt VERS or to ensure we have obvious conversion and mapping between the two. CVE is using something that's more inspired from the OSV notation FWIW. (And OSV also use the univers code https://github.com/google/osv.dev/tree/master/osv/third_party/univers which is the library that was developed in parallel to the spec to ensure things would work as planned https://github.com/aboutcode-org/univers )

In the end, beyond the notation, this is about having a decent database and indexing implementation that can do that kind of queries (and expose that in APIs if need be).

[tschmidtb51]

@rjb4standards re:

Does anyone know of any plans to support the VERSION-RANGE-SPEC within the NIST NVD or other CVE reporting platform search functions, i.e. EUVD? I'm hoping to be able to search these vulnerability databases across multiple versions, i.e. show my all the CVE's for Version 5.0.0 to 7.0.0 of Product P.

As far as I know, EUVD is using vers already internally and intend to provide their data as CSAF. Whether they expose this function through their API is a question for the owners of that database. As they are using vulnerability-lookup the question there might also be worth a try.

[tschmidtb51]

Original question is resolved, so I'm closing this.