purl
Package URL
A structured identifier for a package’s ecosystem, namespace, name, version and qualifiers, such as pkg:npm/lodash@4.17.21. It identifies a component, not whether a deployment is affected by a vulnerability.
- Defined in
- Package URL specification
Covered in
Guide
Choose SBOM formats and identify components accurately
Separate schema versions, document references and package identities so inventory conversion and advisory matching preserve meaning.
Guide
Use VEX without losing vulnerability evidence
Produce and consume precise vulnerability status statements tied to the product, version, justification and evidence.