[rahul05ranjan]

Fixes #226.

Raw scan results carry versionless purls — the detected version lives in the entry's version field. Both converters keyed their summaries by that bare purl and skipped any purl already stored ("Component … already stored"), so when the same component was detected at several versions, only the first survived in SPDX Lite and CycloneDX output, while the Default JSON kept them all. The repo's own tests/data/result.json shows it directly: scanner.c is detected at 1.3.3 and 1.1.4, engine at 5.4.0 and 4.0.4 — the old assertions of 6 packages were counting the bug.

Change: both converters now key by the purl with the detected version attached (_versioned_purl): versionless purl + entry version → purl@version; purls that already carry a version (only the part before ? is inspected, so qualifiers are left alone) and entries with no version keep the old key, so genuine duplicates still deduplicate. Consequences, all deliberate:

• SPDX Lite emits one package per detected version, each with its own SPDXID, versionInfo and purl referenceLocator (the package purl is the same purl@version string the old code already produced for the first version).
• CycloneDX emits one component per version; purl and bom-ref are the versioned purl, which is the recommended bom-ref shape.
• CycloneDX vulnerability affects refs now use the same versioned key, so they keep matching the components they were reported for (a CVE listed on both files' entries affects both versions).

Verification. This host has no packageurl/importlib_resources/cyclonedx-python-lib installs available, so I could not run make unit_test as-is; instead I ran the suite through a small harness that stubs exactly those third-party imports (python -m unittest discovery over tests/test_spdxlite.py + the new tests/test_sbom_component_versions.py): 22 tests, all pass — the 14 existing SPDX Lite tests (with the 6→8 counts updated for result.json's two extra versions) and 8 new tests covering: both versions kept by each converter, one SPDX package per version with distinct IDs, same-version duplicates still deduped, versioned purls untouched, missing version falling back to the bare purl, and vulnerability affects covering both versions when reported on both. Before the change, the two parse tests see exactly one component where two are expected. In CI (python -m unittest, real deps) these run unmodified.

[agustingroh]

Hi @rahul05ranjan, thanks a lot for this, and sorry for the overlap. We had been working on the same issue internally and opened #228, which also fixes the vulnerability refs in the folder-hash output, shares the purl helper between both converters, and is part of the 1.54.3 release. Your PR was a useful cross-check, especially the qualifier handling, which we picked up as well.

I'll close this one in favour of #228. Thanks again, and contributions are always welcome!