# package URL

Published articles for package URL.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Dependency graph supports all purl-identified package ecosystems

DevFeed: [Dependency graph supports all purl-identified package ecosystems](<https://devfeed.tech/articles/dependency-graph-supports-all-purl-identified-package-ecosystems-72665.md>)

Original publisher: [Read original article](<https://github.blog/changelog/2025-04-03-dependency-graph-supports-all-purl-identified-package-ecosystems>)

Author: Allison

Published: 2025-04-04T04:50:37Z

Content type: release

Language: en

Sources: [GitHub Changelog](<https://devfeed.tech/sources/github-changelog.md>)

Topics: [Dependency management](<https://devfeed.tech/topics/dependency-management.md>), [Graphs](<https://devfeed.tech/topics/graphs.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [dependency](<https://devfeed.tech/tags/dependency.md>), [dependency-graph](<https://devfeed.tech/tags/dependency-graph.md>), [ecosystem](<https://devfeed.tech/tags/ecosystem.md>), [ecosystems](<https://devfeed.tech/tags/ecosystems.md>), [graphql](<https://devfeed.tech/tags/graphql.md>), [package-url](<https://devfeed.tech/tags/package-url.md>), [purl](<https://devfeed.tech/tags/purl.md>), [relationships](<https://devfeed.tech/tags/relationships.md>), [sboms](<https://devfeed.tech/tags/sboms.md>)

### AI overview

For graphs submitted through GitHub's dependency submission API, packages identified by Package URL (`purl`) now retain submitted direct and transitive relationships, display the ecosystem's registered name in Dependency Graph insights, and expose the submitted URL as `packageUrl` in GraphQL's `DependencyGraphDependency` object. For search and filtering, their top-level `ecosystem` type is now `other` instead of `unknown`. To use the feature, add a dependency submission action for a supported ecosystem, then open the repository's Insights tab and select Dependency graph.

### Source excerpt

GitHub's dependency graph now supports a wider range of package ecosystems, including transitive path information and the registered name of the ecosystem. This change increases the accuracy and usefulness of...

## Generated SBOM files will now include a package URL when a manifest file includes a range

DevFeed: [Generated SBOM files will now include a package URL when a manifest file includes a range](<https://devfeed.tech/articles/generated-sbom-files-will-now-include-a-package-url-when-a-manifest-file-includes-a-range-73084.md>)

Original publisher: [Read original article](<https://github.blog/changelog/2024-06-11-generated-sbom-files-will-now-include-a-package-url-when-a-manifest-file-includes-a-range>)

Author: Allison

Published: 2024-06-11T16:24:38Z

Content type: release

Language: en

Sources: [GitHub Changelog](<https://devfeed.tech/sources/github-changelog.md>)

Topics: [image manifest](<https://devfeed.tech/topics/image-manifest.md>)

Tags: [include](<https://devfeed.tech/tags/include.md>), [manifest](<https://devfeed.tech/tags/manifest.md>), [package-url](<https://devfeed.tech/tags/package-url.md>), [range](<https://devfeed.tech/tags/range.md>), [sbom](<https://devfeed.tech/tags/sbom.md>)

### AI overview

GitHub updated its SBOM generation so package URLs are included when a manifest references a package version range. The optional version field is omitted in that case, yielding more complete SBOM data to help users identify packages in their repositories.

### Source excerpt

Until this release, when a manifest file included a version range of a package (e.g. version < 3), when GitHub generated an SBOM for that package, it would not include...

## A purl of wisdom on SBOMs and vulnerabilities

DevFeed: [A purl of wisdom on SBOMs and vulnerabilities](<https://devfeed.tech/articles/a-purl-of-wisdom-on-sboms-and-vulnerabilities-12860.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/a-purl-of-wisdom-on-sboms-and-vulnerabilities>)

Published: 2023-02-14T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [open-source-security](<https://devfeed.tech/topics/open-source-security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>)

Tags: [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [component](<https://devfeed.tech/tags/component.md>), [components](<https://devfeed.tech/tags/components.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [false-positive](<https://devfeed.tech/tags/false-positive.md>), [nvd](<https://devfeed.tech/tags/nvd.md>), [package-url](<https://devfeed.tech/tags/package-url.md>), [purl](<https://devfeed.tech/tags/purl.md>), [sbom](<https://devfeed.tech/tags/sbom.md>), [sboms](<https://devfeed.tech/tags/sboms.md>), [scanner](<https://devfeed.tech/tags/scanner.md>), [software-bill-of-materials](<https://devfeed.tech/tags/software-bill-of-materials.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [vulnerability-data](<https://devfeed.tech/tags/vulnerability-data.md>), [vulnerability-scanner](<https://devfeed.tech/tags/vulnerability-scanner.md>), [vulnerability-scanning](<https://devfeed.tech/tags/vulnerability-scanning.md>)

### AI overview

The article argues that Software Bill of Materials (SBOMs) would be more useful if the National Vulnerability Database (NVD) widely adopted the package URL (purl) naming scheme. Analysis of real scanner false positives suggests that purl information could reduce the false positive rate by more than 50%.

### Source excerpt

SBOMs could be a lot more useful if the NVD implemented widespread usage of the purl naming scheme, which could reduce the false positive rate by over 50%.